Bagisto versions up to 2.3.15 contain a cross-site scripting (XSS) vulnerability in an unspecified functionality of the Custom Scripts Handler component. This vulnerability allows remote attackers to inject malicious scripts. The issue has a low CVSS score of 3.5 and requires user interaction with low privileges. The vendor has acknowledged the issue and plans to fix it in upcoming releases but no patch is currently available.