QwikSec

Security Database

CVE

CWE

Training

CVE-2026-25482

Published: Feb 3, 2026

Modified: Feb 4, 2026

PUBLISHED

Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Vendor	Product	Versions
craftcms	commerce	affected `>= 5.0.0, < 5.5.2` affected `>= 4.0.0-RC1, < 4.10.1`

Weaknesses (CWE)

References

https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j

x_refsource_CONFIRM

https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65

x_refsource_MISC

https://github.com/craftcms/commerce/releases/tag/4.10.1

x_refsource_MISC

https://github.com/craftcms/commerce/releases/tag/5.5.2

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.