6.1Medium
CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| craftcms | commerce | >= 4.0.0-RC1, < 4.10.1, >= 5.0.0, < 5.5.2 | |
| craftcms | craft commerce | 4.0.1 – < 4.10.1 |
References and patches
- https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc ExploitVendor Advisory
- https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee Patch
- https://github.com/craftcms/commerce/releases/tag/4.10.1 Release Notes
- https://github.com/craftcms/commerce/releases/tag/5.5.2 Release Notes
CPE matches (NVD) (4)
cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*≥ 4.0.1 < 4.10.1cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*≥ 5.0.0 < 5.5.2cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:*cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:*