6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25522

CVE-2026-25522: Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25522

CVE-2026-25522:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0-RC1, <= 5.5.1	5.5.2
craftcms/commerce	composer	>= 4.0.0-RC1, <= 4.10.0	4.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Craft Commerce plugin. The root cause is the failure to properly sanitize user-controllable data before it is rendered in the admin panel. The advisory specifically calls out the 'Name' and 'Description' fields for Shipping Zones, and the patch confirms this. When an administrator with sufficient permissions creates an entity (like a shipping zone) and injects HTML/JavaScript into certain fields, that payload is stored in the database. The vulnerable functions identified are controller actions responsible for fetching this data and preparing it for display in various tables within the admin UI (e.g., /admin/commerce/store-management/primary/shippingzones). The original code directly used the raw data from the database. When another administrator views the page containing this data, the malicious script executes in their browser, leading to potential actions like session hijacking or privilege escalation, as demonstrated in the proof-of-concept. The provided patch addresses the issue by applying Html::encode() to the output, which neutralizes the malicious scripts. While the advisory focuses on Shipping Zones, the patch proactively fixes the same flaw across multiple controllers handling similar data types (Tax Zones, Shipping Categories, etc.), all of which are included in the analysis.

Vulnerable functions

craftcms\commerce\controllers\ShippingZonesController::actionIndex

src/controllers/ShippingZonesController.php

The function retrieves shipping zone data, including 'name' and 'description', and prepares it for display in a table. The original code did not encode these values, allowing malicious HTML/JavaScript stored in these fields to be rendered directly in the admin panel, leading to a stored cross-site scripting (XSS) vulnerability.

craftcms\commerce\controllers\InventoryLocationsController::actionInventoryLocationsTableData

src/controllers/InventoryLocationsController.php

This function prepares inventory location data for a table view. The 'address' field, which can contain user-supplied data, was not encoded before being passed to the view. This allows for stored XSS if a malicious address is saved.

craftcms\commerce\controllers\ShippingCategoriesController::actionIndex

src/controllers/ShippingCategoriesController.php

Similar to the primary vulnerability, this function failed to encode the 'name' and 'description' of shipping categories before rendering them in the admin panel, creating a stored XSS vulnerability.

craftcms\commerce\controllers\ShippingMethodsController::actionIndex

src/controllers/ShippingMethodsController.php

The function did not encode the 'name' of shipping methods. If a shipping method is created with a malicious name containing JavaScript, it would be executed in the browser of an administrator viewing the shipping methods list.

craftcms\commerce\controllers\TaxCategoriesController::actionIndex

src/controllers/TaxCategoriesController.php

This function was vulnerable to stored XSS because it did not encode the 'name' and 'description' fields of tax categories before displaying them, allowing arbitrary script execution.

craftcms\commerce\controllers\TaxRatesController::actionIndex

src/controllers/TaxRatesController.php

The function failed to encode the 'name' of the tax rate and the 'name' of the associated tax zone, creating multiple vectors for stored XSS within the tax rates table.

craftcms\commerce\controllers\TaxZonesController::actionIndex

src/controllers/TaxZonesController.php

The 'name' and 'description' fields for tax zones were not properly sanitized before being rendered in the UI. This allowed for stored XSS when an administrator views the list of tax zones.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.