CVE-2026-25487: Craft Commerce Stored XSS Vulnerability

CVE-2026-25487 Overview

CVE-2026-25487 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce, the ecommerce platform for Craft CMS. The vulnerability exists because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This allows attackers with sufficient privileges to inject malicious JavaScript that executes in an administrator's browser when viewing the affected admin pages.

Critical Impact

Attackers can execute arbitrary JavaScript in administrator browsers, potentially leading to session hijacking, admin account takeover, or malicious actions performed under the administrator's identity.

Affected Products

• Craft Commerce versions 4.0.0-RC1 through 4.10.0
• Craft Commerce versions 5.0.0 through 5.5.1
• Craft CMS installations using affected Craft Commerce plugin versions

Discovery Timeline

• 2026-02-03 - CVE-2026-25487 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25487

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in Craft Commerce's admin panel where user-supplied input in the Tax Rates 'Name' field is rendered without proper output encoding. When an administrator views pages that display this field, any injected JavaScript code executes within their authenticated browser session.

The vulnerability requires network access and high privileges (an authenticated user with access to Store Management), along with user interaction (an administrator must view the affected page). While the attack requires specific conditions, successful exploitation can lead to significant integrity impacts in the downstream system, including unauthorized modifications to the commerce platform configuration.

Root Cause

The root cause is improper neutralization of input during web page generation. The Tax Rates 'Name' field and other similar fields throughout the Store Management section were not passing user-controlled data through proper HTML encoding functions before rendering in the admin panel templates. This allowed HTML special characters and JavaScript code to be interpreted as executable content rather than displayed as text.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with access to the Store Management section of Craft Commerce. The attacker injects malicious JavaScript into the Tax Rates 'Name' field. When an administrator subsequently views any page that renders this field value, the malicious script executes in their browser context with full access to their authenticated session.

// Vulnerable pattern - data rendered without encoding
// src/controllers/ShippingCategoriesController.php (before patch)
         // Generate table data with chips
         $tableData = [];
         foreach ($shippingCategories as $shippingCategory) {
-            $label = Craft::t('site', $shippingCategory->name);
+            $label = Html::encode(Craft::t('site', $shippingCategory->name));
             $tableData[] = [
                 'id' => $shippingCategory->id,
                 'title' => $label,

Source: GitHub Commit Changes

// Additional fix in InventoryLocationsController.php
                 'id' => $inventoryLocation->id,
                 'title' => $inventoryLocation->getUiLabel(),
                 'handle' => $inventoryLocation->handle,
-                'address' => $inventoryLocation->getAddressLine(),
+                'address' => Html::encode($inventoryLocation->getAddressLine()),
                 'url' => $inventoryLocation->getCpEditUrl(),
                 'delete' => $inventoryLocations->count() > 1 ? $deleteButton : '',
             ];

Source: GitHub Commit Changes

Detection Methods for CVE-2026-25487

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in Tax Rates names or other Store Management field values
• Suspicious characters such as <script>, javascript:, or event handlers (onerror, onload) in database records for commerce settings
• Administrator reports of unexpected browser behavior or redirects when accessing the Craft Commerce admin panel

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor web application firewall (WAF) logs for XSS payload patterns in POST requests to Store Management endpoints
• Review database fields in Craft Commerce tables for HTML/JavaScript content that shouldn't be present in name fields
• Enable audit logging for changes to Tax Rates and other Store Management configurations

Monitoring Recommendations

• Configure browser console monitoring for JavaScript errors that may indicate failed XSS attempts
• Set up alerts for modifications to Tax Rates or shipping category names containing special HTML characters
• Monitor admin session activity for unusual actions that may indicate session hijacking following XSS exploitation

How to Mitigate CVE-2026-25487

Immediate Actions Required

• Upgrade Craft Commerce to version 4.10.1 (for 4.x branch) or version 5.5.2 (for 5.x branch) immediately
• Audit existing Tax Rates and Store Management field values for suspicious content and sanitize any malicious entries
• Implement Content Security Policy headers to provide defense-in-depth against XSS attacks
• Review admin user accounts for any unauthorized changes that may have occurred during the vulnerability window

Patch Information

Craft CMS has released security patches addressing this vulnerability. The fix applies proper HTML encoding using Html::encode() to user-controlled data before rendering in admin panel views. Users should upgrade to the following patched versions:

• Craft Commerce 4.x: Upgrade to version 4.10.1 or later
• Craft Commerce 5.x: Upgrade to version 5.5.2 or later

For technical details on the fix, see the GitHub Security Advisory GHSA-wqc5-485v-3hqh.

Workarounds

• Restrict access to the Store Management section to only essential administrator accounts until patching is complete
• Implement a Web Application Firewall (WAF) rule to filter XSS payloads in POST requests to Craft Commerce admin endpoints
• Enable Content Security Policy headers with strict script-src directives to mitigate script injection impact

# Example Nginx CSP header configuration for Craft CMS admin
location /admin {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';" always;
}