Medium severity · published Feb 3, 2026
CVE-2026-25486
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commerce · craftcms
>= 5.0.0, < 5.5.2 · source: vendor
CC
Craft Commerce · Craftcms
5.0.0 before 5.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25486
Patch
https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee
Release Notes
https://github.com/craftcms/commerce/releases/tag/5.5.2
Exploit
https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22
More from commerce
8.8
CVE-2026-29174
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
8.8
CVE-2026-29172
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
8.7
CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
7.7
CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
6.9
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass