Stored XSS Vulnerability in Craft Commerce by Craft CMS
CVE-2026-25489
6.1MEDIUM
What is CVE-2026-25489?
Craft Commerce, an ecommerce platform built for Craft CMS, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability when using versions from 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. This security flaw arises due to insufficient sanitization of the Name and Description fields in Tax Zones, allowing an attacker to inject malicious JavaScript that executes in an administrator's browser. The issue has been addressed and patched in versions 4.10.1 and 5.5.2. It is crucial for users to update to these versions to maintain the security of their ecommerce operations.
Affected Version(s)
commerce >= 4.0.0-RC1, < 4.10.1 < 4.0.0-RC1, 4.10.1
commerce >= 5.0.0, < 5.5.2 < 5.0.0, 5.5.2