GHSA-frj9-9rwc-pw9j
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.0.0-RC1 | 4.10.1 |
| Packagist | craftcms/commerce | 5.0.0 | 5.5.2 |
Related vulnerabilities
- CVE-2026-25482 Craft Commerce is an ecommerce platform for Craft CMS. Same vulnerability
- CVE-2026-25522 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25486 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25487 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25489 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25488 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25490 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25484 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce