Missing Authorization

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Missing Authorization via the actionPay process. An attacker can access sensitive customer order information, including email and address details, by submitting an order number and causing the email...

SQL Injection

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to SQL Injection via the hasVariant or hasProduct properties, which bypass input sanitization in subqueries. An attacker can extract arbitrary database contents, including sensitive security keys, by...

SQL Injection

craftcms/commerce is vulnerable to SQL Injection. The vulnerability is due to lack of validation and sanitization of sort parameters in the addOrderBy clause, which allows an attacker to inject arbitrary SQL queries and potentially compromise the database...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS in the processing of order details in the slideout interface when user-supplied input is rendered without proper sanitization in fields such as Shipping Method Name, Order...

Cross-site Scripting (XSS)

craftcms/commerce is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the Tax Zone name and description fields, which allows an attacker to inject and execute malicious JavaScript in an administrator’s browser via the admin panel...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name and Description fields in the tax categories section of the admin panel. An attacker can execute arbitrary JavaScript code in the context of an administrator's...

Cross-site Scripting (XSS)

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the value.name field in the dashboard widget. An attacker can execute arbitrary JavaScript in the context of an admin user's browser by injecting malicious scripts into...

CVE-2026-25522

creationtimestamp| type| source ---|---|--- 2026-02-02 20:59:20+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m...