Mitch45

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** A flaw in the Customer-Registration Notification Email component allows remote attackers to perform basic cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue exists within an unknown function of the `/customer/register` file and is triggered by manipulating the `first name` and `last name` variables. **Recommendations** Update to a version newer than 2.4.4. As a temporary mitigation, restrict or sanitize the input for the `first name` and `last name` variables in the `/customer/register` endpoint.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** A remote attack is possible due to an issue in the RMA State Validation component. Manipulation of the `/customer/account/rma/update-status` endpoint leads to the enforcement of a behavioral workflow. **Recommendations** Update to a version newer than 2.4.4. As a temporary mitigation, restrict access to the `/customer/account/rma/update-status` endpoint.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** Cross site scripting occurs in the RMA Message Handler component due to the manipulation of the `Message` argument within the '/customer/account/rma/send-message' endpoint. This allows for remote exploitation. **Recommendations** Update to a version newer than 2.4.4. Avoid using the `Message` argument in the '/customer/account/rma/send-message' endpoint until the update is applied.