Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed commerce (craftcms): 4.10.1, 5.5.2craftcms/commerce (Packagist): 5.5.2, 4.10.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | commerce | 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 | 4.10.1, 5.5.2 | Patch available | CNA |
| — | craftcms/commerce (Packagist) | 5.0.0-RC1 to before 5.5.2 | 5.5.2 | Patch available | GHSA-wq2m-r96q-crrf |
| — | craftcms/commerce (Packagist) | 4.0.0-RC1 to before 4.10.1 | 4.10.1 | Patch available | GHSA-wq2m-r96q-crrf |
- commerce VendorCraft CMS Affected 4.0.0-RC1 to before 4.10.1; 5.0.0 to before 5.5.2 Fixed in 4.10.1, 5.5.2 Patch available CNA
- craftcms/commerce (Packagist) Vendor— Affected 5.0.0-RC1 to before 5.5.2 Fixed in 5.5.2 Patch available GHSA-wq2m-r96q-crrf
- craftcms/commerce (Packagist) Vendor— Affected 4.0.0-RC1 to before 4.10.1 Fixed in 4.10.1 Patch available GHSA-wq2m-r96q-crrf
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* | 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* | 4.0.0 | Vulnerable | Craft CMS |
| cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* | 4.0.0 rc1 | Vulnerable | Craft CMS |
- cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 4.0.1 to before 4.10.1; 5.0.0 to before 5.5.2 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:* Versions 4.0.0 Vulnerable ·Craft CMS
- cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:* Versions 4.0.0 rc1 Vulnerable ·Craft CMS
Remediation
- Fix · CNA commerce (craftcms) Fixed in 4.10.1, 5.5.2
- Fix · GHSA-wq2m-r96q-crrf craftcms/commerce (Packagist) Fixed in 5.5.2 Advisory →
- Fix · GHSA-wq2m-r96q-crrf craftcms/commerce (Packagist) Fixed in 4.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25490
- 2026-10-03 Alias added: GHSA-wq2m-r96q-crrf
References
More Craft CMS Craft Commerce vulnerabilities
- TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
- TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
- TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
- TI-2026-20598 Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
Sources
- CVE-2026-25490 · CVE Program
- CVE-2026-25490 · NVD
- FIRST EPSS
- GHSA-wq2m-r96q-crrf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences