6.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25485

CVE-2026-25485: Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25485

CVE-2026-25485:

6.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/composer	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2
craftcms/composer	composer	>= 4.0.0-RC1, <= 4.10.0	4.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Craft Commerce plugin. The root cause is the failure to properly sanitize user-provided input before it is rendered in the admin control panel. The provided patch fa273330807807d05b564d37c88654cd772839ee reveals that this was a widespread problem affecting multiple controllers responsible for displaying store management data in tables.

The vulnerability description specifically highlights the 'Shipping Categories' name and description fields. However, the commit shows that numerous other fields across different management pages (Inventory, Shipping Methods, Shipping Zones, Tax Categories, Tax Rates, and Tax Zones) were also vulnerable. In each case, data such as names, descriptions, and addresses were being retrieved from the database and placed into a data array for rendering without being escaped.

The fix applied in the patch is to wrap the potentially malicious data points with the Html::encode() function. This function neutralizes any embedded HTML or script tags, preventing them from being executed by the browser. Any of the actionIndex or action...TableData methods in the patched controllers would appear in a runtime profile or stack trace during the exploitation of this vulnerability, as they are responsible for processing and outputting the tainted data.

Vulnerable functions

craftcms\commerce\controllers\ShippingCategoriesController::actionIndex

src/controllers/ShippingCategoriesController.php

The function retrieves shipping categories and prepares them for display in a table. The `name` and `description` fields, which can be controlled by a user with permissions to manage shipping, were not sanitized before being rendered. This allows for the injection of malicious HTML and JavaScript, leading to a stored cross-site scripting (XSS) vulnerability.

craftcms\commerce\controllers\InventoryLocationsController::actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

This function prepares inventory location data for a table view. The `address` field was not being HTML-encoded, creating a stored XSS vulnerability if a user with appropriate permissions could set a malicious address.

craftcms\commerce\controllers\ShippingMethodsController::actionIndex

src/controllers/ShippingMethodsController.php

The `name` of a shipping method was rendered without proper sanitization in the shipping methods table, leading to a stored XSS vulnerability. An attacker with permissions to manage shipping methods could inject malicious scripts.

craftcms\commerce\controllers\ShippingZonesController::actionIndex

src/controllers/ShippingZonesController.php

The `name` and `description` of shipping zones were not sanitized before being displayed in the admin panel. This allowed for stored XSS by users with permissions to manage shipping zones.

craftcms\commerce\controllers\TaxCategoriesController::actionIndex

src/controllers/TaxCategoriesController.php

The `name` and `description` fields for tax categories were rendered without HTML encoding, creating a stored XSS vulnerability. An attacker with permissions to manage store settings could inject malicious scripts.

craftcms\commerce\controllers\TaxRatesController::actionIndex

src/controllers/TaxRatesController.php

The `name` of a tax rate and the `name` of its associated tax zone were not sanitized before being displayed in a table. This created a stored XSS vulnerability exploitable by users with permissions to manage store settings.

craftcms\commerce\controllers\TaxZonesController::actionIndex

src/controllers/TaxZonesController.php

The `name` and `description` of tax zones were rendered without proper HTML encoding, leading to a stored XSS vulnerability. A user with permissions to manage store settings could inject malicious scripts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.