← Vulnerability feed

Vulnerability record · CVE-2026-25486 · published 3 February 2026

CVE-2026-25486: Craftcms craft commerce cross-site scripting vulnerability

Craftcms · Craft Commerce

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.

6.1 CVSS 4.0 Medium EPSS 0.34% · top 75.2% CWE-79 · Cross-site scripting
6.1CVSS 4.0 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee Patch
https://github.com/craftcms/commerce/releases/tag/5.5.2 Release Notes
https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22 ExploitVendor Advisory

Track CVE-2026-25486 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-29172Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables t…EPSS 0.52%8.7CVE-2026-29174Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table da…EPSS 0.52%8.6CVE-2026-29175Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product T…EPSS 0.25%6.3CVE-2026-31867Craftcms craft commerce insecure direct object reference vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in …EPSS 0.32%6.2CVE-2026-25485Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%6.2CVE-2026-25482Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability e…EPSS 0.41%6.2CVE-2026-25483Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exist…EPSS 0.39%6.1CVE-2026-25522Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2026-25486), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.