Webkul vulnerabilities
52 CVEs and advisories name Webkul as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-75081Webkul Bagisto store behavioral workflow
- CVE-2026-19997Webkul Bagisto Backend Sales RMA Endpoint requests authorization
- CVE-2026-19996Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
- CVE-2026-19995Webkul Bagisto RMA Message send-message cross site scripting
- CVE-2026-19994Webkul Bagisto Configuration Management execute authorization
- CVE-2026-19993Webkul Bagisto RMA State Validation update-status behavioral workflow
- CVE-2026-19838Webkul Bagisto Backend Reporting Endpoint sales authorization
- CVE-2026-19837Webkul Bagisto Customer Search search information disclosure
- CVE-2026-19836Webkul Bagisto Backend Customer Detail Feature view authorization
- CVE-2026-19835Webkul Bagisto Customer Item Deletion Endpoint access control
- CVE-2026-19834Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
- CVE-2026-60120Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
- CVE-2017-20262Joomla! Component Ajax Quiz 1.8 SQL Injection
- CVE-2026-9506Path Traversal Vulnerability in Bagisto
- CVE-2025-10759Webkul QloApps CSRF Token authorization
- CVE-2025-29009WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability
- CVE-2025-6173Webkul QloApps ajax_products_list.php sql injection
- CVE-2025-3568Webkul Krayin CRM SVG File edit cross site scripting
- CVE-2025-1155Webkul QloApps Your Location Search stores cross site scripting
- CVE-2025-1074Webkul QloApps URL mylogout cross-site request forgery
- CVE-2024-11281WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change
- CVE-2023-2925Webkul krayin crm Edit Person Page 2 cross site scripting