Craft CMS

Records204All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high90CVSS 7.0–8.9

Exploited now

Craft CMS records in CISA KEV

TI-2025-23503 Craft CMS Code Injection Vulnerability CRITICAL 100KEV 2026-03-20 TI-2024-37138 Craft CMS Code Injection Vulnerability CRITICAL 99KEV 2025-06-02 TI-2025-24595 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability CRITICAL 88KEV 2025-06-02 TI-2025-16994 Craft CMS Code Injection Vulnerability CRITICAL 94KEV 2025-02-20

Components

Products in the NVD configurations · select one to filter the records

Craft Cms 97 records CRITICAL Craft Commerce 17 records HIGH

Records

17 records in Craft Commerce · all components

TI-2026-23289 CVE-2026-29172 · GHSA-j3x5-mghf-xvfw

Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting

HIGH 79

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-03-10 Fixed in 4.10.2, 5.5.3 CWE-89

TI-2026-23292 CVE-2026-29175 · GHSA-cfpv-rmpf-f624

Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking

HIGH 72

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00235 Published 2026-03-10 Fixed in 5.5.3 CWE-79

TI-2026-20631 CVE-2026-25522 · GHSA-h9r9-2pxg-cx9m

Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20601 CVE-2026-25490 · GHSA-wq2m-r96q-crrf

Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20600 CVE-2026-25489 · GHSA-v585-mf6r-rqrc

Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.00322 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20599 CVE-2026-25488 · GHSA-p6w8-q63m-72c8

Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.003 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20598 CVE-2026-25487 · GHSA-wqc5-485v-3hqh

Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20597 CVE-2026-25486 · GHSA-g92v-wpv7-6w22

Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

MEDIUM 60

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.1 Network High privileges User interaction EPSS 0.00288 Published 2026-02-03 Fixed in 5.5.2 CWE-79

TI-2026-23291 CVE-2026-29174 · GHSA-pmgj-gmm4-jh6j

Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting

MEDIUM 40

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00491 Published 2026-03-10 Fixed in 5.5.3 CWE-89

TI-2026-24419 CVE-2026-31867 · GHSA-vff3-pqq8-4cpq

Craft Commerce has a Potential IDOR in Commerce carts

LOW 28

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00323 Published 2026-03-11 Fixed in 4.11.0, 5.6.0 CWE-639

TI-2026-20594 CVE-2026-25483 · GHSA-8478-rmjg-mjj5

Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

LOW 28

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00342 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-20593 CVE-2026-25482 · GHSA-frj9-9rwc-pw9j

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

LOW 28

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.2 Network High privileges User interaction EPSS 0.00345 Published 2026-02-03 Fixed in 5.5.2, 4.10.1 CWE-79

TI-2026-20596 CVE-2026-25485 · GHSA-w8gw-qm8p-j9j3

Cross-site scripting in Craft CMS commerce

LOW 27

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 6.2 Network High privileges User interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-23293 CVE-2026-29176 · GHSA-wj89-2385-gpx3

Craft Commerce has Stored XSS in Inventory Location Name

LOW 22

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0027 Published 2026-03-10 Fixed in 5.5.3 CWE-79

TI-2026-20595 CVE-2026-25484 · GHSA-2h2m-v2mg-656c

Craft Commerce has Stored XSS in Product Type Name

LOW 22

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.10.1, 5.5.2 CWE-79

TI-2026-23290 CVE-2026-29173 · GHSA-mqxf-2998-c6cp

Craft Commerce has Stored XSS while updating Order Status from Orders Table

LOW 11

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0LOW 1.9 Network High privileges User interaction EPSS 0.00367 Published 2026-03-10 Fixed in 4.10.2, 5.5.3 CWE-79

TI-2026-23294 CVE-2026-29177 · GHSA-mj32-r678-7mvp

Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

LOW 10

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0LOW 1.9 Network Low privileges User interaction EPSS 0.00244 Published 2026-03-10 Fixed in 4.10.2, 5.5.3 CWE-79

Open these records in search →