Read the docs
TI-2026-20597 Aliases CVE-2026-25486GHSA-g92v-wpv7-6w22

Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed commerce (craftcms): 5.5.2craftcms/commerce (Packagist): 5.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScommerce5.0.0 to before 5.5.25.5.2Patch availableCNA
—craftcms/commerce (Packagist)5.0.0-RC1 to before 5.5.25.5.2Patch availableGHSA-g92v-wpv7-6w22
  • commerce VendorCraft CMS Affected 5.0.0 to before 5.5.2 Fixed in 5.5.2 Patch available CNA
  • craftcms/commerce (Packagist) Vendor— Affected 5.0.0-RC1 to before 5.5.2 Fixed in 5.5.2 Patch available GHSA-g92v-wpv7-6w22

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*5.0.0 to before 5.5.2VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 5.0.0 to before 5.5.2 Vulnerable ·Craft CMS

Remediation

  • Fix · CNA commerce (craftcms) Fixed in 5.5.2
  • Fix · GHSA-g92v-wpv7-6w22 craftcms/commerce (Packagist) Fixed in 5.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25486
  2. 2026-10-03 Alias added: GHSA-g92v-wpv7-6w22

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
  • TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
  • TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20601 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences