CVE-2026-25497 is a high-severity privilege escalation vulnerability in Craft CMS versions from 4.0.0-RC1 up to before 4.17.0-beta.1 and 5.9.0-beta.1. It affects the GraphQL API, specifically the saveAsset mutation, allowing an authenticated user with write access to one asset volume to modify or transfer assets in other volumes without proper authorization checks.
CVE-2026-25496 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The issue arises because the Prefix and Suffix fields in the Number field type settings are rendered using the raw Twig filter without proper escaping, allowing malicious scripts to execute when these fields are displayed on user profiles.
CVE-2026-25495 is a high-severity SQL Injection vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The flaw exists in the element-indexes/get-elements endpoint, specifically via the criteria[orderBy] parameter in the JSON request body, which is not properly sanitized before being used in an SQL ORDER BY clause.
CVE-2026-25494 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The vulnerability arises because the saveAsset GraphQL mutation uses PHP's filter_var function with FILTER_VALIDATE_IP to block certain IP addresses, but this function does not recognize alternative IP notations such as hexadecimal or mixed formats.
CVE-2026-25493 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The vulnerability arises because the saveAsset GraphQL mutation attempts to block SSRF by validating the initial URL hostname and resolved IP against a blocklist, but the underlying HTTP client (Guzzle) follows redirects by default.
CVE-2026-25492 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It arises from the save_images_Asset GraphQL mutation, which improperly validates hostnames and allows fetching internal URLs by resolving domain names to internal IP addresses.
CVE-2026-25491 is a stored cross-site scripting (XSS) vulnerability in CraftCMS versions from 5.0.0-RC1 up to 5.8.21. The vulnerability arises because Entry Type names are not properly sanitized when displayed in the Entry Types list, allowing malicious scripts to be stored and executed in the context of the CMS interface. This flaw requires authenticated users with privileges to create or modify Entry Types and some user interaction to trigger the payload. The vulnerability has a low CVSS score of 1.9 and is fixed in version 5.8.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
CVE-2026-25488 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Tax Categories (Name & Description) fields in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25487 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper sanitization of the Tax Rates 'Name' field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25486 is a stored cross-site scripting (XSS) vulnerability affecting Craft Commerce versions 5.0.0 through 5.5.1. The flaw arises from improper sanitization of the Shipping Methods Name field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser. Exploitation requires the attacker to have high privileges to input data and some user interaction by an admin to trigger the payload. The vulnerability has been patched in version 5.5.2.
CVE-2026-25485 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Shipping Categories fields (Name & Description) in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25484 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises because product type names are not properly sanitized when displayed in the CMS user permissions settings, allowing malicious scripts to be stored and executed.
CVE-2026-25483 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper input neutralization in the Order Status History Message, which is rendered with a filter allowing raw HTML, enabling malicious script execution.
CVE-2026-25482 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper escaping of the Order Status Name in the "Recent Orders" dashboard widget, which is rendered via JavaScript string concatenation.
CVE-2025-68456 is a high-severity vulnerability in Craft CMS versions 3.0.0 through 4.16.16 and 5.0.0-RC1 through 5.8.20 that allows unauthenticated users to trigger database backup operations. This can lead to resource exhaustion or potential information disclosure due to lack of limits or throttling on resource allocation.
CVE-2025-68455 is a high-severity vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20, allowing authenticated administrators to execute remote code via maliciously crafted Behaviors. The flaw arises from unsafe reflection (CWE-470), where externally controlled input is used to select classes or code, enabling potential Remote Code Execution (RCE).
CVE-2025-68454 is a medium-severity vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20 that allows authenticated users to perform remote code execution (RCE) via Server-Side Template Injection (SSTI) in Twig templates. Exploitation requires administrator access with allowAdminChanges enabled or non-admin access with System Messages utility permissions.
