6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25486

CVE-2026-25486: Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25486

CVE-2026-25486:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Craft Commerce plugin. An attacker with permissions to manage store settings can inject malicious JavaScript into various text fields, such as the 'Name' field for shipping methods, shipping categories, tax categories, and more. The root cause is the failure to properly sanitize this user-provided input before it is rendered in the administrator's control panel. The provided patch addresses this by applying Html::encode() to the output in multiple controller actions responsible for displaying this data. When an administrator views a page containing the malicious payload (e.g., the shipping methods list), the script executes in their browser context. This can be leveraged for session hijacking, UI redressing, or, as demonstrated in the proof-of-concept, privilege escalation by forcing the administrator's browser to make an API call to grant the attacker's account administrative privileges.

Vulnerable functions

craftcms\commerce\controllers\ShippingMethodsController::actionIndex

src/controllers/ShippingMethodsController.php

The function retrieves shipping methods and prepares them for display. The `name` of the shipping method was used to create a label without proper HTML encoding, making it vulnerable to stored XSS when a malicious name is rendered in the admin panel.

craftcms\commerce\controllers\InventoryLocationsController::actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

The function retrieves inventory locations and their addresses. The address line was rendered without HTML encoding, allowing for stored XSS if a malicious address is provided.

craftcms\commerce\controllers\ShippingCategoriesController::actionIndex

src/controllers/ShippingCategoriesController.php

This function displays shipping categories. Both the `name` and `description` fields were rendered without proper encoding, creating a stored XSS vulnerability.

craftcms\commerce\controllers\ShippingZonesController::actionIndex

src/controllers/ShippingZonesController.php

The `name` and `description` of shipping zones were displayed without HTML encoding, leading to a stored XSS vulnerability in the shipping zones listing page.

craftcms\commerce\controllers\TaxCategoriesController::actionIndex

src/controllers/TaxCategoriesController.php

The `name` and `description` of tax categories were rendered without proper sanitization, allowing for stored XSS.

craftcms\commerce\controllers\TaxRatesController::actionIndex

src/controllers/TaxRatesController.php

The `name` of the tax rate and the `name` of the associated tax zone were not encoded, creating a stored XSS vulnerability.

craftcms\commerce\controllers\TaxZonesController::actionIndex

src/controllers/TaxZonesController.php

The `name` and `description` of tax zones were rendered without HTML encoding, leading to a stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.