PT-2026-6294 · Pixel & Tonic · Craft Commerce

Mhe4Am · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25485

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1

Description Craft Commerce, an ecommerce platform for Craft CMS, contains a stored cross-site scripting (XSS) issue. The issue resides in the Shipping Categories (Name & Description) fields within the Store Management section of the admin panel. Improper sanitization of input in these fields allows attackers to inject malicious JavaScript code. Successful exploitation can lead to the execution of arbitrary JavaScript in an administrator’s browser. An attacker could potentially escalate privileges to administrator level by exploiting this issue, especially if an elevated session exists. The attacker can leverage the XSS to create a fake 'Session Expired' login modal, tricking administrators into submitting their credentials. The vulnerable fields are located at the /admin/commerce/store-management/primary/shippingcategories endpoint. The Name and Description parameters are vulnerable to XSS attacks.

Recommendations Craft Commerce versions 4.0.0-RC1 through 4.10.0 should be updated to version 4.10.1 or later. Craft Commerce versions 5.0.0 through 5.5.1 should be updated to version 5.5.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25485

GHSA-W8GW-QM8P-J9J3

Affected Products

Craft Commerce

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25485.json · Exploit
• https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee · Patch
• https://github.com/craftcms/commerce/security/advisories/GHSA-w8gw-qm8p-j9j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25485 · Security Note
• https://osv.dev/vulnerability/GHSA-w8gw-qm8p-j9j3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25485 · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/releases/tag/4.10.1 · Note
• https://github.com/craftcms/commerce/releases/tag/5.5.2 · Note