PT-2026-5748 · Pixel & Tonic · Craft Commerce

Mhe4Am · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25488

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1

Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting (XSS) issue. The issue resides in the Tax Categories (Name & Description) fields within the Store Management section, which are not adequately sanitized before display in the admin panel. This allows attackers to inject malicious JavaScript code that executes in an administrator’s browser. Successful exploitation could lead to privilege escalation to administrator level, potentially through session hijacking or credential theft via a fake login modal. The vulnerability requires an active administrator session. The API endpoint /admin/commerce/store-management/primary/taxcategories is involved in the exploitation. The vulnerable parameters are the Name and Description fields. The fetch function is used in a payload to potentially modify user permissions.

Recommendations Craft Commerce versions 4.0.0-RC1 through 4.10.0 should be updated to version 4.10.1 or later. Craft Commerce versions 5.0.0 through 5.5.1 should be updated to version 5.5.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25488

GHSA-P6W8-Q63M-72C8

Affected Products

Craft Commerce

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25488.json · Exploit
• https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee · Patch
• https://github.com/craftcms/commerce/security/advisories/GHSA-p6w8-q63m-72c8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25488 · Security Note
• https://osv.dev/vulnerability/GHSA-p6w8-q63m-72c8 · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/releases/tag/4.10.1 · Note
• https://github.com/craftcms/commerce/releases/tag/5.5.2 · Note