6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25487

CVE-2026-25487: Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25487

CVE-2026-25487:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2
craftcms/commerce	composer	>= 4.0.0-RC1, <= 4.10.0	4.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Craft CMS Commerce plugin. The root cause is the failure to properly sanitize user-provided input before it is rendered in the admin panel. Specifically, fields such as 'Name', 'Description', and 'Address' across various store management sections (Tax Rates, Shipping Categories, etc.) were not being HTML-encoded.

An attacker with permissions to manage store settings could insert malicious JavaScript payloads into these fields. When a privileged administrator views the pages listing these items, the malicious scripts would execute in their browser. This could be leveraged for various attacks, including session hijacking, UI redressing, or, as demonstrated in the proof-of-concept, privilege escalation by making API calls on the administrator's behalf.

The provided commit fa273330807807d05b564d37c88654cd772839ee addresses this vulnerability by applying the Html::encode() function to the output of these fields across multiple controllers. This ensures that any user-provided data is treated as plain text and not interpreted as HTML or script by the browser, effectively mitigating the XSS vulnerability. The analysis identified all the controller actions that were modified in the patch, as they were all vulnerable to the same type of injection.

Vulnerable functions

craftcms\commerce\controllers\TaxRatesController::actionIndex

src/controllers/TaxRatesController.php

The 'name' of a tax rate was rendered without proper HTML encoding on the tax rates listing page. This allowed for a stored Cross-Site Scripting (XSS) vulnerability. An attacker could create a tax rate with a malicious name containing a JavaScript payload. This payload would then execute in the browser of any administrator viewing the tax rates list, potentially leading to privilege escalation.

craftcms\commerce\controllers\InventoryLocationsController::actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

The address of an inventory location was rendered without proper HTML encoding. This created a stored Cross-Site Scripting (XSS) vulnerability, as a malicious address could contain a JavaScript payload that would execute in an administrator's browser.

craftcms\commerce\controllers\ShippingCategoriesController::actionIndex

src/controllers/ShippingCategoriesController.php

The 'name' and 'description' of a shipping category were rendered without proper HTML encoding, leading to a stored Cross-Site Scripting (XSS) vulnerability. An attacker could inject a JavaScript payload into these fields, which would then execute in an administrator's browser.

craftcms\commerce\controllers\ShippingMethodsController::actionIndex

src/controllers/ShippingMethodsController.php

The 'name' of a shipping method was rendered without proper HTML encoding, creating a stored Cross-Site Scripting (XSS) vulnerability. A malicious name could contain a JavaScript payload that would execute in an administrator's browser.

craftcms\commerce\controllers\ShippingZonesController::actionIndex

src/controllers/ShippingZonesController.php

The 'name' and 'description' of a shipping zone were rendered without proper HTML encoding, resulting in a stored Cross-Site Scripting (XSS) vulnerability. An attacker could inject a JavaScript payload into these fields, which would execute in an administrator's browser.

craftcms\commerce\controllers\TaxCategoriesController::actionIndex

src/controllers/TaxCategoriesController.php

The 'name' and 'description' of a tax category were rendered without proper HTML encoding, leading to a stored Cross-Site Scripting (XSS) vulnerability. An attacker could inject a JavaScript payload into these fields, which would execute in an administrator's browser.

craftcms\commerce\controllers\TaxZonesController::actionIndex

src/controllers/TaxZonesController.php

The 'name' and 'description' of a tax zone were rendered without proper HTML encoding, creating a stored Cross-Site Scripting (XSS) vulnerability. An attacker could inject a JavaScript payload into these fields, which would execute in an administrator's browser.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.