CVE-2026-25486 json
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
published 2026-02-02 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-5206 , GHSA-g92v-wpv7-6w22
- cvss
- 4.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.
Patch / fix
- packagist craftcms/commerce 5.5.2
- craftcms craft_commerce 5.5.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N |
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/commerce | >=5.0.0-RC1, <5.5.2 |
5.5.2 |
Affected products
- craftcms commerce
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee
web, patch
-
github.com
/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22
web, exploit, vendor-advisory
-
github.com
/craftcms/commerce/releases/tag/5.5.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-25486
advisory
-
github.com
/craftcms/commerce
package
Sources
- CVE List CVE-2026-25486
- GitHub Advisory GHSA-g92v-wpv7-6w22
- NVD CVE-2026-25486
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.