CVE-2026-25490
Medium · 4.8CVSS
4.8
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.0.0-RC1 | 4.10.1 |
| Packagist | craftcms/commerce | 5.0.0-RC1 | 5.5.2 |
Related vulnerabilities
- GHSA-wq2m-r96q-crrf Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential… Same vulnerability
- CVE-2026-25522 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25486 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25487 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25489 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25488 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25482 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25484 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce