Back to search
CVE-2026-25489
Published: Feb 3, 2026
Modified: Feb 3, 2026
PUBLISHED
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
| Vendor | Product | Versions |
|---|---|---|
craftcms | commerce | affected >= 4.0.0-RC1, < 4.10.1affected >= 5.0.0, < 5.5.2 |
Weaknesses (CWE)
References
https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc
x_refsource_CONFIRM
https://github.com/craftcms/commerce/releases/tag/4.10.1
x_refsource_MISC
https://github.com/craftcms/commerce/releases/tag/5.5.2
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now