Medium severity · published Feb 3, 2026
CVE-2026-25483
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commerce · craftcms
>= 4.0.0-RC1, < 4.10.1; >= 5.0.0, < 5.5.2 · source: vendor
CC
Craft Commerce · Craftcms
4.0.1 before 4.10.1; 5.0.0 before 5.5.2; 4.0.0; 4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25483
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25483
Patch
https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c
Release Notes
https://github.com/craftcms/commerce/releases/tag/4.10.1
Release Notes
https://github.com/craftcms/commerce/releases/tag/5.5.2
Exploit
https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5
More from commerce
8.8
CVE-2026-29174
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
8.8
CVE-2026-29172
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
8.7
CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
7.7
CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
6.9
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass