Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS in the orderHistory.message. An attacker can execute arbitrary scripts in the context of the admin panel by injecting malicious payloads into the status message field, which...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the value.name field in the dashboard widget. An attacker can execute arbitrary JavaScript in the context of an admin user's browser by injecting malicious scripts into...

GHSA-FRJ9-9RWC-PW9J Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

CVE-2026-25522

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:20+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m...

CVE-2026-25490

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:15+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-wq2m-r96q-crrf...

CVE-2026-25489

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:08+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc...

CVE-2026-25488

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:58+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-p6w8-q63m-72c8...

CVE-2026-25486

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:53+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22...

CVE-2026-25485

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:44+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-w8gw-qm8p-j9j3...

CVE-2026-25484

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:38+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c...

CVE-2026-25483

creationtimestamp| type| source ---|---|--- 2026-02-02 20:58:25+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5...

CVE-2026-25482

creationtimestamp| type| source ---|---|--- 2026-02-02 20:57:49+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j...

PT-2026-6493

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin...

PT-2026-6294

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting XSS issue. The issue resides in the Shipping...

PT-2026-5746

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 5.0.0 through 5.5.1 Description A stored cross-site scripting XSS issue exists in Craft Commerce that allows attackers to execute malicious JavaScript in an administrator’s browser. The issue stems from insufficient...

PT-2026-6432

Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone Name & Description fields in the Store Management section are not properly sanitized before being displayed in the admin panel...

PT-2026-5747

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting XSS issue. The issue resides in the Tax Rates...

PT-2026-5745

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description A Stored Cross-Site Scripting XSS issue exists in Craft Commerce through Product Type names. The product type name is not properly sanitiz...

PT-2026-5744

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce is susceptible to a stored cross-site scripting XSS issue within the Order Status History Message functionality. The system...

PT-2026-6293

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description A stored DOM Cross-Site Scripting XSS issue exists within the "Recent Orders" dashboard widget. The Order Status Name is rendered using...