CVE-2026-6745 is a stored cross-site scripting (XSS) vulnerability affecting Bagisto e-commerce platform versions up to 2.3.15, specifically within the Custom Scripts Handler component. The vulnerability allows remote authenticated attackers to inject malicious scripts through an unknown functionality. The vulnerability carries a CVSS 3.5 low severity rating, requiring network access and low attack complexity but necessitating user interaction and valid credentials. The impact is limited to integrity compromise with no confidentiality or availability degradation. The EPSS score of 0.00029 suggests minimal real-world exploitation probability compared to other CVEs. Exploit code has been publicly disclosed and is available to researchers and potential threat actors. While the vulnerability is listed on the active Hot List, indicating community attention and heightened monitoring, it is not currently tracked in CISA's Known Exploited Vulnerabilities catalog. Bagisto's vendor response indicates awareness and commitment to remediation in upcoming releases, though patches had not been released at the time of this advisory.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| N/A | Bagisto | 2.3.0, 2.3.1, 2.3.10, 2.3.11, 2.3.12, 2.3.13, 2.3.14, 2.3.15, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.