CVE-2026-25483
MEDIUM EPSS 21.6%
Published Feb 3, 20264mo ago · Modified Jun 17, 20261w ago
6.2 CVSS 4.0
Published Feb 3, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction P
Scope X
Threat Intelligence
EPSS Exploit Probability
21.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 4
References 4
- github.com https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c
- github.com https://github.com/craftcms/commerce/releases/tag/4.10.1
- github.com https://github.com/craftcms/commerce/releases/tag/5.5.2
- github.com https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5
Remediation
- github.com https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c
- github.com https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5