6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25488

CVE-2026-25488: Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Tax Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25488

CVE-2026-25488:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2
craftcms/commerce	composer	>= 4.0.0-RC1, <= 4.10.0	4.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Craft Commerce plugin. The root cause is the failure to properly sanitize user-controllable input before it is rendered in the admin panel. The provided patch (fa273330807807d05b564d37c88654cd772839ee) clearly shows that multiple controller actions were vulnerable. These actions retrieve data from the database (like tax category names, shipping zone descriptions, etc.) and prepare it for display in a table view. Before the patch, this data was directly passed to the view, allowing any stored JavaScript to be executed in the browser of a user viewing the page. The fix involves consistently applying Html::encode() to all data that is displayed, which neutralizes any malicious scripts. While the vulnerability report specifically highlights the 'Tax Categories' section, the patch reveals the issue was systemic across several other management pages in the admin panel, including shipping, inventory, and other tax-related settings.

Vulnerable functions

craftcms\commerce\controllers\TaxCategoriesController::actionIndex

src/controllers/TaxCategoriesController.php

The function retrieves tax categories and renders their `name` and `description` without proper HTML encoding. An attacker can create a tax category with a malicious payload in these fields, which will be executed in the browser of an administrator viewing the tax categories list.

craftcms\commerce\controllers\InventoryLocationsController::actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

The function retrieves inventory locations and renders the address line without proper HTML encoding, making it vulnerable to stored XSS.

craftcms\commerce\controllers\ShippingCategoriesController::actionIndex

src/controllers/ShippingCategoriesController.php

The function retrieves shipping categories and renders their `name` and `description` without proper HTML encoding, making it vulnerable to stored XSS.

craftcms\commerce\controllers\ShippingMethodsController::actionIndex

src/controllers/ShippingMethodsController.php

The function retrieves shipping methods and renders their `name` without proper HTML encoding, making it vulnerable to stored XSS.

craftcms\commerce\controllers\ShippingZonesController::actionIndex

src/controllers/ShippingZonesController.php

The function retrieves shipping zones and renders their `name` and `description` without proper HTML encoding, making it vulnerable to stored XSS.

craftcms\commerce\controllers\TaxRatesController::actionIndex

src/controllers/TaxRatesController.php

The function retrieves tax rates and renders their `name` and associated tax zone name without proper HTML encoding, making it vulnerable to stored XSS.

craftcms\commerce\controllers\TaxZonesController::actionIndex

src/controllers/TaxZonesController.php

The function retrieves tax zones and renders their `name` and `description` without proper HTML encoding, making it vulnerable to stored XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.