Bagisto vulnerabilities
13 published CVEs name Bagisto among the affected products.
- 13Published CVEs13 of them scored
- 7Last 12 monthspublished in the last year
- 0Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-121628
Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
bagisto · bagisto
Medium6.3 - CVE-2026-21450
Bagisto has SSTI in parameter that can lead to RCE
bagisto · bagisto
High7.3 - CVE-2026-21451
Bagisto has HTML Filter Bypass that Enables Stored XSS
bagisto · bagisto
Medium5.2 - CVE-2026-21449
Bagisto has SSTI via first and last name from low-privilege user (not admin)
bagisto · bagisto
High7.4 - CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
bagisto · bagisto
High8.9 - CVE-2026-21447
Bagisto has IDOR in Customer Order Reorder Functionality
bagisto · bagisto
High7.1 - CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
bagisto · bagisto
High8.8 - CVE-2025-62415
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)
bagisto · bagisto
Medium6.9 - CVE-2025-62418
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
bagisto · bagisto
Medium6.9 - CVE-2025-62414
bagisto - Cross Site Scripting (XSS) in Create New Customer
bagisto · bagisto
Medium6.9