Webkul Bagisto Input Validation Flaws

Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.

Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.