Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M
CVE-2026-25485Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium 6.2
In plain English
A medium-severity cross-site scripting in commerce from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/composer | 5.5.2 | GHSA-w8gw-qm8p-j9j3 |
| Packagist | craftcms/composer | 4.10.1 | GHSA-w8gw-qm8p-j9j3 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
References
- https://github.com/craftcms/commerce/security/advisories/GHSA-w8gw-qm8p-j9j3 x_refsource_CONFIRM
- https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee x_refsource_MISC
- https://github.com/craftcms/commerce/releases/tag/4.10.1 x_refsource_MISC
- https://github.com/craftcms/commerce/releases/tag/5.5.2 x_refsource_MISC