GHSA-WQC5-485V-3HQH Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. Proof of Concept...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Name field of the tax rates management section. An attacker can execute arbitrary JavaScript code in an administrator's browser by submitting specially crafted input,...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in the shipping methods section of store management. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting a crafted...

Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. --- Proof o...

GHSA-G92V-WPV7-6W22 Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. --- Proof o...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Shipping Categories fields in the Store Management section, which are not properly sanitized before being displayed in the admin panel. An attacker can execute...

Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin...

GHSA-W8GW-QM8P-J9J3 Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin...

GHSA-2H2M-V2MG-656C Craft Commerce has Stored XSS in Product Type Name

Summary Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type settings, but the sink is in CMS user permissions settings. Reporting to Commerce GHSA since the input originates here. Users a...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in the Product Type settings. An attacker with administrative access to modify Commerce settings, can execute arbitrary JavaScript code in the context of...

GHSA-8478-RMJG-MJJ5 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS in the orderHistory.message. An attacker can execute arbitrary scripts in the context of the admin panel by injecting malicious payloads into the status message field, which...

Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

GHSA-FRJ9-9RWC-PW9J Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

CVE-2026-25489

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:08+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc...

CVE-2026-25488

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:58+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-p6w8-q63m-72c8...

CVE-2026-25484

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:38+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c...

CVE-2026-25483

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:25+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5...

CVE-2026-25482

creationtimestamp| type| source ---|---|--- 2026-02-02 20:57:49+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j...

PT-2026-6311

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting XSS issue. The vulnerability resides in the...