CraftCMS commerce

• CVE-2026-55795 Medium 6.9 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass 0.5%
• CVE-2026-32272 High 8.7 Craft Commerce: Blind SQL Injection via hasVariant/hasProduct 0.3%
• CVE-2026-32271 High 7.7 Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget 0.5%
• CVE-2026-32270 Low 1.7 Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments 0.3%
• CVE-2026-31867 Medium 6.3 Craft Commerce has a Potential IDOR in Commerce carts 0.3%
• CVE-2026-29177 Low 1.9 Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout 0.2%
• CVE-2026-29176 Medium 4.8 Craft Commerce has Stored XSS in Inventory Location Name 0.3%
• CVE-2026-29175 High 8.6 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking 0.2%
• CVE-2026-29174 High 8.7 Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting 0.5%
• CVE-2026-29173 Low 1.9 Craft Commerce has Stored XSS while updating Order Status from Orders Table 0.4%
• CVE-2026-29172 High 8.7 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting 0.5%
• CVE-2026-25522 Medium 6.1 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25490 Medium 6.1 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25489 Medium 6.1 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25488 Medium 6.1 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25487 Medium 6.1 Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25486 Medium 6.1 Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25485 Medium 6.2 Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation 0.3%
• CVE-2026-25484 Medium 4.8 Craft Commerce has Stored XSS in Product Type Name 0.3%
• CVE-2026-25483 Medium 6.2 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration 0.3%
• CVE-2026-25482 Medium 6.2 Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) 0.3%