8522 matches found
Cross-site Scripting (XSS)
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Shipping Categories fields in the Store Management section, which are not properly sanitized before being displayed in the admin panel. An attacker can execute...
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin...
GHSA-W8GW-QM8P-J9J3 Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin...
GHSA-2H2M-V2MG-656C Craft Commerce has Stored XSS in Product Type Name
Summary Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type settings, but the sink is in CMS user permissions settings. Reporting to Commerce GHSA since the input originates here. Users a...
Cross-site Scripting (XSS)
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in the Product Type settings. An attacker with administrative access to modify Commerce settings, can execute arbitrary JavaScript code in the context of...
Craft Commerce has Stored XSS in Product Type Name
Summary Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type settings, but the sink is in CMS user permissions settings. Reporting to Commerce GHSA since the input originates here. Users a...
Cross-site Scripting (XSS)
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS in the orderHistory.message. An attacker can execute arbitrary scripts in the context of the admin panel by injecting malicious payloads into the status message field, which...
GHSA-8478-RMJG-MJJ5 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...
GHSA-FRJ9-9RWC-PW9J Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...
Cross-site Scripting (XSS)
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the value.name field in the dashboard widget. An attacker can execute arbitrary JavaScript in the context of an admin user's browser by injecting malicious scripts into...
CVE-2026-25522
creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:20+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m...
CVE-2026-25490
creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:15+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-wq2m-r96q-crrf...
CVE-2026-25489
creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:08+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc...
CVE-2026-25488
creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:58+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-p6w8-q63m-72c8...
CVE-2026-25486
creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:53+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22...
CVE-2026-25485
creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:44+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-w8gw-qm8p-j9j3...
CVE-2026-25484
creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:38+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c...