A basic cross-site scripting vulnerability (CVE-2026-75082) affects Webkul Bagisto versions 2.4.0 to 2.4.4 in the /customer/register endpoint of the Customer-Registration Notification Email component. The vulnerability arises from improper handling of the first_name and last_name input parameters, allowing an attacker to inject malicious scripts. This flaw can be exploited remotely without privileges or user interaction. The vendor has internally identified and partially addressed the issue prior to public disclosure, with remaining fixes planned in upcoming releases. No official patch links are provided yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the affected component. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited to a medium severity level as per CVSS 4.0, indicating no direct system compromise or data loss is implied.

The vendor has confirmed that some fixes have already been applied internally and that remaining issues are planned to be resolved in future product releases. No official patches or updates are currently publicly available. Users should monitor vendor communications for upcoming releases addressing this vulnerability. Until then, consider applying input validation or sanitization on the affected parameters as a temporary mitigation.