Craft Commerce has Stored XSS in Product Type Name
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed commerce (craftcms): 4.10.1, 5.5.2craftcms/commerce (Packagist): 5.5.2, 4.10.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | commerce | 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 | 4.10.1, 5.5.2 | Patch available | CNA |
| — | craftcms/commerce (Packagist) | 5.0.0 to before 5.5.2 | 5.5.2 | Patch available | GHSA-2h2m-v2mg-656c |
| — | craftcms/commerce (Packagist) | 4.0.0-RC1 to before 4.10.1 | 4.10.1 | Patch available | GHSA-2h2m-v2mg-656c |
- commerce VendorCraft CMS Affected 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 Fixed in 4.10.1, 5.5.2 Patch available CNA
- craftcms/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.5.2 Fixed in 5.5.2 Patch available GHSA-2h2m-v2mg-656c
- craftcms/commerce (Packagist) Vendor— Affected 4.0.0-RC1 to before 4.10.1 Fixed in 4.10.1 Patch available GHSA-2h2m-v2mg-656c
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* | 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* | 4.0.0 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* | 4.0.0 rc1 | Vulnerable | Craft CMS |
- cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* Versions 4.0.0 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* Versions 4.0.0 rc1 Vulnerable ·Craft CMS
Remediation
- Fix · CNA commerce (craftcms) Fixed in 4.10.1, 5.5.2
- Fix · GHSA-2h2m-v2mg-656c craftcms/commerce (Packagist) Fixed in 5.5.2 Advisory →
- Fix · GHSA-2h2m-v2mg-656c craftcms/commerce (Packagist) Fixed in 4.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25484
- 2026-10-03 Alias added: GHSA-2h2m-v2mg-656c
References
More Craft CMS Craft Commerce vulnerabilities
- TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
- TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
- TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20601 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
Sources
- CVE-2026-25484 · CVE Program
- CVE-2026-25484 · NVD
- FIRST EPSS
- GHSA-2h2m-v2mg-656c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences