PT-2026-5750 · Pixel & Tonic · Craft Commerce

Mhe4Am · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25490

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1

Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting (XSS) issue. The issue stems from insufficient sanitization of the 'Address Line 1' field within Inventory Locations before display in the admin panel. This allows attackers to inject malicious JavaScript code that executes in an administrator’s browser. An attacker could potentially escalate privileges to administrator level by exploiting this issue, especially if an elevated session exists. The proof of concept demonstrates that an attacker can inject a payload into the 'Address Line 1' field, which then executes JavaScript when the page is loaded. A malicious payload can be used to steal administrator credentials through a fake login modal or directly elevate the attacker’s account to admin status.

Recommendations Craft Commerce versions 4.0.0-RC1 through 4.10.0 should be upgraded to version 4.10.1 or later. Craft Commerce versions 5.0.0 through 5.5.1 should be upgraded to version 5.5.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25490

GHSA-WQ2M-R96Q-CRRF

Affected Products

Craft Commerce

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25490.json · Exploit
• https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee · Patch
• https://github.com/craftcms/commerce/security/advisories/GHSA-wq2m-r96q-crrf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wq2m-r96q-crrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25490 · Security Note
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/releases/tag/4.10.1 · Note
• https://github.com/craftcms/commerce/releases/tag/5.5.2 · Note