The vulnerability in Webkul Bagisto prior to version 2.4.4 is a stored cross-site scripting issue caused by client-side template injection. Attackers can register a customer account embedding malicious JavaScript in the first or last name fields. The create.blade.php template fails to use the Vue.js v-pre directive, which would prevent Vue.js from interpreting template expressions. As a result, when an administrator opens the Create Order page for the affected customer, the malicious payload executes in their browser context. This vulnerability requires no authentication to register the malicious account but does require an administrator to view the affected page to trigger the exploit.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of administrators who open the Create Order page for the malicious customer. This can lead to session hijacking, unauthorized actions performed with administrator privileges, or other attacks facilitated by JavaScript execution in a privileged context. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial impact on confidentiality and integrity.

A fix is available in Webkul Bagisto version 2.4.4 and later. Users should upgrade to version 2.4.4 or newer to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed in vendor advisories here, so verify with Webkul's official resources for the latest remediation guidance.