Stored XSS Vulnerability in Craft Commerce Affects Craft CMS
CVE-2026-25488
6.1MEDIUM
What is CVE-2026-25488?
Craft Commerce, an eCommerce platform designed for Craft CMS, has a stored XSS vulnerability that impacts versions from 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability occurs due to insufficient input sanitization of the Tax Categories' Name and Description fields within the Store Management section. This flaw allows attackers to inject and execute malicious JavaScript within an administrator’s browser, potentially compromising sensitive data and the security of the application. The issue has been resolved in versions 4.10.1 and 5.5.2, so users are advised to upgrade their installations to mitigate the risk.
Affected Version(s)
commerce >= 4.0.0-RC1, < 4.10.1 < 4.0.0-RC1, 4.10.1
commerce >= 5.0.0, < 5.5.2 < 5.0.0, 5.5.2