CVE-2026-25487
Medium · 4.8CVSS
4.8
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.0.0-RC1 | 4.10.1 |
| Packagist | craftcms/commerce | 5.0.0-RC1 | 5.5.2 |
Related vulnerabilities
- GHSA-wqc5-485v-3hqh Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation Same vulnerability
- CVE-2026-25522 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25486 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25489 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25488 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25490 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25482 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25484 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce