CVE-2026-75082

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5

Description A flaw in the Customer-Registration Notification Email component allows remote attackers to perform basic cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue exists within an unknown function of the /customer/register file and is triggered by manipulating the first name and last name variables.

Recommendations Update to a version newer than 2.4.4. As a temporary mitigation, restrict or sanitize the input for the first name and last name variables in the /customer/register endpoint.