Cross-site scripting in Craft CMS commerce
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed commerce (craftcms): 4.10.1, 5.5.2craftcms/composer (Packagist): 5.5.2, 4.10.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | commerce | 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 | 4.10.1, 5.5.2 | Patch available | CNA |
| — | craftcms/composer (Packagist) | 5.0.0-RC1 to before 5.5.2 | 5.5.2 | Patch available | GHSA-w8gw-qm8p-j9j3 |
| — | craftcms/composer (Packagist) | 4.0.0-RC1 to before 4.10.1 | 4.10.1 | Patch available | GHSA-w8gw-qm8p-j9j3 |
- commerce VendorCraft CMS Affected 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 Fixed in 4.10.1, 5.5.2 Patch available CNA
- craftcms/composer (Packagist) Vendor— Affected 5.0.0-RC1 to before 5.5.2 Fixed in 5.5.2 Patch available GHSA-w8gw-qm8p-j9j3
- craftcms/composer (Packagist) Vendor— Affected 4.0.0-RC1 to before 4.10.1 Fixed in 4.10.1 Patch available GHSA-w8gw-qm8p-j9j3
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* | 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* | 4.0.0 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* | 4.0.0 rc1 | Vulnerable | Craft CMS |
- cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* Versions 4.0.0 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* Versions 4.0.0 rc1 Vulnerable ·Craft CMS
Remediation
- Fix · CNA commerce (craftcms) Fixed in 4.10.1, 5.5.2
- Fix · GHSA-w8gw-qm8p-j9j3 craftcms/composer (Packagist) Fixed in 5.5.2 Advisory →
- Fix · GHSA-w8gw-qm8p-j9j3 craftcms/composer (Packagist) Fixed in 4.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25485
- 2026-10-03 Alias added: GHSA-w8gw-qm8p-j9j3
References
More Craft CMS Craft Commerce vulnerabilities
- TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
- TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
- TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20601 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
Sources
- CVE-2026-25485 · CVE Program
- CVE-2026-25485 · NVD
- FIRST EPSS
- GHSA-w8gw-qm8p-j9j3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences