PT-2026-5745 · Pixel & Tonic · Craft Commerce

Mhe4Am · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25484

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1

Description A Stored Cross-Site Scripting (XSS) issue exists in Craft Commerce through Product Type names. The product type name is not properly sanitized when displayed within user permission settings. The vulnerable input is located in Commerce (Product Type settings), while the vulnerable display occurs in CMS user permissions settings. The API endpoint for creating a new Product Type is /admin/commerce/settings/producttypes. The vulnerable parameter is Name. The vulnerable display occurs when accessing user permissions at /admin/users/{UserID}/permissions.

Recommendations Update to Craft Commerce version 4.10.1 or later. Update to Craft Commerce version 5.5.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25484

GHSA-2H2M-V2MG-656C

Affected Products

Craft Commerce

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25484.json · Exploit
• https://github.com/craftcms/commerce/commit/7e1dedf06038c8e70dce0187b7048d4ab8ffb75c · Patch
• https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25484 · Security Note
• https://osv.dev/vulnerability/GHSA-2h2m-v2mg-656c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25484 · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/releases/tag/4.10.1 · Note
• https://github.com/craftcms/commerce/releases/tag/5.5.2 · Note