GHSA-wq2m-r96q-crrf
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.0.0-RC1 | 4.10.1 |
| Packagist | craftcms/commerce | 5.0.0-RC1 | 5.5.2 |
Related vulnerabilities
- CVE-2026-25490 Craft Commerce is an ecommerce platform for Craft CMS. Same vulnerability
- CVE-2026-25522 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25486 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25487 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25489 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25488 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25482 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce
- CVE-2026-25484 Craft Commerce is an ecommerce platform for Craft CMS. Also affects craftcms/commerce