CVE-2026-25486 Overview
Craft Commerce is an ecommerce platform built on top of Craft CMS. A stored cross-site scripting (XSS) vulnerability affects versions 5.0.0 through 5.5.1. The Shipping Methods Name field within the Store Management section fails to sanitize user-supplied input before rendering it in the administrator panel. An authenticated user with permission to manage shipping methods can inject JavaScript that executes in any administrator's browser session viewing the affected page. The issue is tracked as [CWE-79] and was patched in version 5.5.2.
Critical Impact
Authenticated attackers can store malicious JavaScript that executes in administrator browsers, enabling session theft, privileged action abuse, and pivot into store data.
Affected Products
- Craft Commerce 5.0.0 through 5.5.1
- Craft CMS installations running vulnerable Craft Commerce versions
- Administrator interface of the Store Management module
Discovery Timeline
- 2026-02-03 - CVE-2026-25486 published to NVD
- 2026-02-10 - Last updated in NVD database
Technical Details for CVE-2026-25486
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79]. Craft Commerce accepts a free-form Name value when an operator creates or edits a shipping method through the Store Management section. The application persists this value and later renders it inside the admin panel without sufficient output encoding or input sanitization. As a result, an attacker who can submit shipping method configurations can embed JavaScript that runs whenever an administrator loads the relevant admin view. The payload executes within the administrator's authenticated origin, granting it access to session cookies, CSRF tokens, and Document Object Model (DOM) content of privileged pages.
Root Cause
The root cause is missing contextual output encoding when the Shipping Methods Name field is reflected in administrative templates. The field is treated as trusted content despite being attacker-controllable through standard store configuration workflows. The patch commit fa273330807807d05b564d37c88654cd772839ee introduces proper encoding to neutralize HTML and script content at render time.
Attack Vector
Exploitation requires network access to the Craft Commerce admin interface and an account with privileges to manage shipping methods. The attacker creates or modifies a shipping method, setting the Name field to a payload containing HTML or JavaScript. When a higher-privileged administrator views any page that renders this shipping method label, the payload executes in their browser. The attack abuses the trust boundary between merchant operators and store administrators, and it can be used to escalate privileges, exfiltrate order data, or modify store configuration through forged requests.
No verified proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-g92v-wpv7-6w22 for vendor-confirmed technical details.
Detection Methods for CVE-2026-25486
Indicators of Compromise
- Shipping method Name values containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading the Store Management or Shipping Methods pages.
- Unexpected administrator account changes, new API tokens, or shipping configuration edits made from administrator sessions without a corresponding operator action.
Detection Strategies
- Review the commerce_shippingmethods table or equivalent data store for Name values containing angle brackets, quotes, or JavaScript keywords.
- Inspect web server access logs for POST requests to shipping method create or update endpoints originating from low-privilege accounts.
- Enable and review Craft Commerce audit logs to correlate shipping method edits with subsequent administrator session activity.
Monitoring Recommendations
- Alert on administrator browser sessions issuing API calls that do not match the navigated UI workflow.
- Monitor Content Security Policy (CSP) violation reports from the admin panel for blocked inline script execution attempts.
- Track version inventory for Craft Commerce installations and flag any instance below 5.5.2.
How to Mitigate CVE-2026-25486
Immediate Actions Required
- Upgrade Craft Commerce to version 5.5.2 or later across all environments.
- Audit existing shipping method records and remove or sanitize any Name values containing HTML or script content.
- Rotate administrator session tokens and API keys if suspicious shipping method entries are found.
Patch Information
The fix is included in Craft Commerce 5.5.2. The remediation is implemented in commit fa273330807807d05b564d37c88654cd772839ee. See the GitHub Release 5.5.2 and the GitHub Security Advisory GHSA-g92v-wpv7-6w22 for vendor guidance.
Workarounds
- Restrict the Manage Shipping Methods permission to fully trusted administrative users until the upgrade is applied.
- Deploy a Content Security Policy that disallows inline scripts on admin panel routes to limit payload execution.
- Place the Craft CMS admin interface behind network controls or a web application firewall configured to inspect form fields for script content.
# Configuration example: upgrade Craft Commerce via Composer
composer require craftcms/commerce:^5.5.2 --with-all-dependencies
php craft migrate/all
php craft clear-caches/all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
