Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed commerce (craftcms): 5.5.2, 4.10.1craftcms/commerce (Packagist): 5.5.2, 4.10.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | commerce | 5.0.0 to before 5.5.2; 4.0.0-RC1 to before 4.10.1 | 5.5.2, 4.10.1 | Patch available | CNA |
| — | craftcms/commerce (Packagist) | 5.0.0 to before 5.5.2 | 5.5.2 | Patch available | GHSA-frj9-9rwc-pw9j |
| — | craftcms/commerce (Packagist) | 4.0.0-RC1 to before 4.10.1 | 4.10.1 | Patch available | GHSA-frj9-9rwc-pw9j |
- commerce VendorCraft CMS Affected 5.0.0 to before 5.5.2; 4.0.0-RC1 to before 4.10.1 Fixed in 5.5.2, 4.10.1 Patch available CNA
- craftcms/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.5.2 Fixed in 5.5.2 Patch available GHSA-frj9-9rwc-pw9j
- craftcms/commerce (Packagist) Vendor— Affected 4.0.0-RC1 to before 4.10.1 Fixed in 4.10.1 Patch available GHSA-frj9-9rwc-pw9j
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* | 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* | 4.0.0 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* | 4.0.0 rc1 | Vulnerable | Craft CMS |
- cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* Versions 4.0.0 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* Versions 4.0.0 rc1 Vulnerable ·Craft CMS
Remediation
- Fix · CNA commerce (craftcms) Fixed in 5.5.2, 4.10.1
- Fix · GHSA-frj9-9rwc-pw9j craftcms/commerce (Packagist) Fixed in 5.5.2 Advisory →
- Fix · GHSA-frj9-9rwc-pw9j craftcms/commerce (Packagist) Fixed in 4.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25482
- 2026-10-03 Alias added: GHSA-frj9-9rwc-pw9j
References
More Craft CMS Craft Commerce vulnerabilities
- TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
- TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
- TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20601 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
Sources
- CVE-2026-25482 · CVE Program
- CVE-2026-25482 · NVD
- FIRST EPSS
- GHSA-frj9-9rwc-pw9j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences