Critical Vulnerability Information Target Website: https://demo.bagisto.com, running the latest version of the Bagisto application. Vulnerability Type: XSS (Cross-Site Scripting) Reproduction Steps: 1. Visit https://demo.bagisto.com. 2. Click “Prepare Demo” and wait a few seconds. 3. Click “Admin Panel” in the top-right corner to navigate to the admin dashboard. 4. Log in using default credentials. 5. Navigate to the product catalog (Catalog in the left menu). 6. Select any product and click the arrow button. 7. Scroll down to the product description section. 8. Click the image icon (Insert/Edit Image) to access the upload functionality. 9. Upload a .jpg file containing the following XSS payload (xss.jpg): 10. Click Save. 11. Drag the displayed SVG file from the description to a new browser tab to trigger execution of the uploaded XSS payload. Impact: Successfully triggers an XSS attack, displaying an alert box with the current domain name.