Threats affecting pkg:github/craftcms/commerce

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

CVE-2026-25488 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Tax Categories (Name & Description) fields in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.

CVE-2026-25487 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper sanitization of the Tax Rates 'Name' field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.

CVE-2026-25486 is a stored cross-site scripting (XSS) vulnerability affecting Craft Commerce versions 5.0.0 through 5.5.1. The flaw arises from improper sanitization of the Shipping Methods Name field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser. Exploitation requires the attacker to have high privileges to input data and some user interaction by an admin to trigger the payload. The vulnerability has been patched in version 5.5.2.

CVE-2026-25485 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Shipping Categories fields (Name & Description) in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.

CVE-2026-25484 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises because product type names are not properly sanitized when displayed in the CMS user permissions settings, allowing malicious scripts to be stored and executed.

CVE-2026-25483 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper input neutralization in the Order Status History Message, which is rendered with a filter allowing raw HTML, enabling malicious script execution.

CVE-2026-25482 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper escaping of the Order Status Name in the "Recent Orders" dashboard widget, which is rendered via JavaScript string concatenation.