GHSA-8478-rmjg-mjj5
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.0.0-RC1 | 4.10.1 |
| Packagist | craftcms/commerce | 5.0.0 | 5.5.2 |
Related vulnerabilities
- CVE-2026-25483 Craft Commerce is an ecommerce platform for Craft CMS. Same vulnerability
- CVE-2026-25522 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25486 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25487 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25489 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25488 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25490 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25482 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce