Bagisto vulnerabilities

CVEs per yearBy the year they were published

1. 20256
2. 20267

Newest CVEs

• CVE-2026-121628

  Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

  bagisto · bagisto

  Medium6.3
• CVE-2026-21450

  Bagisto has SSTI in parameter that can lead to RCE

  bagisto · bagisto

  High7.3
• CVE-2026-21451

  Bagisto has HTML Filter Bypass that Enables Stored XSS

  bagisto · bagisto

  Medium5.2
• CVE-2026-21449

  Bagisto has SSTI via first and last name from low-privilege user (not admin)

  bagisto · bagisto

  High7.4
• CVE-2026-21448

  Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

  bagisto · bagisto

  High8.9
• CVE-2026-21447

  Bagisto has IDOR in Customer Order Reorder Functionality

  bagisto · bagisto

  High7.1
• CVE-2026-21446

  Bagisto Missing Authentication on Installer API Endpoints

  bagisto · bagisto

  High8.8
• CVE-2025-62415

  bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

  bagisto · bagisto

  Medium6.9
• CVE-2025-62418

  bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

  bagisto · bagisto

  Medium6.9
• CVE-2025-62414

  bagisto - Cross Site Scripting (XSS) in Create New Customer

  bagisto · bagisto

  Medium6.9