What’s Vulnerable › Vulnerabilities

CVE-2026-25482: Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-79

Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Affected products

• craftcms commerce: from 4.0.1 before 4.10.1; from 5.0.0 before 5.5.2; 4.0.0, 4.0.0-rc1 — fixed in 4.10.1, 5.5.2

How to fix

Upgrade to a fixed version: craftcms commerce 4.10.1, 5.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65
• https://github.com/craftcms/commerce/releases/tag/4.10.1
• https://github.com/craftcms/commerce/releases/tag/5.5.2
• https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j

Get alerted when CVE-2026-25482 or the next vulnerability affects your stack