6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25489

CVE-2026-25489: Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25489

CVE-2026-25489:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2
craftcms/commerce	composer	>= 4.0.0-RC1, <= 4.10.0	4.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Craft Commerce plugin. The root cause is the failure to properly sanitize user-provided input for various fields (such as name, description, and address) before they are rendered in the admin panel. The provided commit fa273330807807d05b564d37c88654cd772839ee addresses this by applying Html::encode() to the output in multiple controllers. While the advisory specifically highlights the 'Tax Zones' section, the patch reveals that the same vulnerability pattern existed across several other controllers responsible for managing inventory, shipping, and taxes. An attacker with sufficient permissions could inject malicious JavaScript into these fields. When an administrator views the affected pages in the admin panel, the malicious scripts would execute in their browser, potentially leading to session hijacking, privilege escalation, or other malicious actions. The identified vulnerable functions are all controller actions responsible for preparing and displaying this data in tables within the admin interface.

Vulnerable functions

craftcms\commerce\controllers\InventoryLocationsController->actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

The function `actionInventoryLocationsTableData` in `InventoryLocationsController` was vulnerable to stored XSS because it did not sanitize the output of `$inventoryLocation->getAddressLine()` before rendering it in the admin panel. An attacker could create an inventory location with a malicious address, which would then be executed in the browser of an administrator viewing the inventory locations table.

craftcms\commerce\controllers\ShippingCategoriesController->actionIndex

src/controllers/ShippingCategoriesController.php

The function `actionIndex` in `ShippingCategoriesController` was vulnerable to stored XSS. It failed to sanitize the `name` and `description` of shipping categories before they were displayed in the admin panel. An attacker could inject malicious scripts into these fields, which would execute in an administrator's browser when viewing the shipping categories list.

craftcms\commerce\controllers\ShippingMethodsController->actionIndex

src/controllers/ShippingMethodsController.php

The `actionIndex` function in `ShippingMethodsController` was vulnerable to stored XSS because it did not properly sanitize the `name` of shipping methods. An attacker could create a shipping method with a malicious name, leading to script execution in an administrator's browser when viewing the list of shipping methods.

craftcms\commerce\controllers\ShippingZonesController->actionIndex

src/controllers/ShippingZonesController.php

The `actionIndex` function in `ShippingZonesController` was vulnerable to stored XSS. It did not sanitize the `name` and `description` fields of shipping zones before rendering them. This allowed an attacker to inject malicious scripts that would be executed in an administrator's browser.

craftcms\commerce\controllers\TaxCategoriesController->actionIndex

src/controllers/TaxCategoriesController.php

The `actionIndex` function in `TaxCategoriesController` was vulnerable to stored XSS because it failed to sanitize the `name` and `description` of tax categories. An attacker could inject malicious scripts into these fields, which would then be executed in the browser of an administrator viewing the tax categories list.

craftcms\commerce\controllers\TaxRatesController->actionIndex

src/controllers/TaxRatesController.php

The `actionIndex` function in `TaxRatesController` was vulnerable to stored XSS. It did not sanitize the `name` of the tax rate or the `name` of its associated tax zone. This allowed for the injection of malicious scripts that would execute in an administrator's browser.

craftcms\commerce\controllers\TaxZonesController->actionIndex

src/controllers/TaxZonesController.php

The `actionIndex` function in `TaxZonesController` is the primary function identified in the vulnerability description. It was vulnerable to stored XSS because it did not sanitize the `name` and `description` fields of tax zones before displaying them in the admin panel. An attacker with permissions to manage taxes could create a tax zone with a malicious name or description, leading to arbitrary JavaScript execution in an administrator's browser. This could be used to escalate privileges.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.