PT-2026-6293 · Craft Cms · Craft Commerce

Mhe4Am · Publicado 2026-02-02 · Atualizado 2026-02-03 · CVE-2026-25482

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1

Description A stored DOM Cross-Site Scripting (XSS) issue exists within the "Recent Orders" dashboard widget. The Order Status Name is rendered using JavaScript string concatenation without appropriate escaping, which allows for script execution when an administrator accesses the dashboard. The issue occurs because the value.name variable, representing the Order Status Name, is directly concatenated into an HTML string without sanitization. This allows malicious tags or scripts within the name to be executed when the HTML is inserted into the DOM. The vulnerable file is vendor/craftcms/commerce/src/templates/ components/widgets/orders/recent/body.twig.

Recommendations Craft Commerce versions 4.0.0-RC1 through 4.10.0: Update to version 4.10.1 or later. Craft Commerce versions 5.0.0 through 5.5.1: Update to version 5.5.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-25482

GHSA-FRJ9-9RWC-PW9J

Produtos afetados

Craft Commerce

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25482.json · Exploit
• https://github.com/craftcms/commerce · Nota
• https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j · Aviso do Fabricante
• https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65 · Correção
• https://github.com/craftcms/commerce/releases/tag/4.10.1 · Nota
• https://github.com/craftcms/commerce/releases/tag/5.5.2 · Nota
• https://osv.dev/vulnerability/GHSA-frj9-9rwc-pw9j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25482 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25482 · Nota de Segurança