CVE-2026-25488: Craft Commerce Stored XSS Vulnerability

CVE-2026-25488 Overview

CVE-2026-25488 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce, the ecommerce platform for Craft CMS. This vulnerability allows attackers to execute malicious JavaScript code in an administrator's browser by exploiting improper input sanitization in the Tax Categories fields within the Store Management section of the admin panel.

The vulnerability exists because the Name and Description fields in Tax Categories are not properly sanitized before being rendered in the admin interface. When an administrator views or manages tax categories containing malicious payloads, the injected JavaScript executes within the context of the authenticated administrator's session.

Critical Impact
Successful exploitation enables attackers to hijack administrator sessions, steal sensitive credentials, modify ecommerce configurations, or perform unauthorized actions within the Craft Commerce admin panel.

Affected Products

Craft Commerce versions 4.0.0-RC1 through 4.10.0
Craft Commerce versions 5.0.0 through 5.5.1
Craft CMS installations with vulnerable Craft Commerce plugin versions

Discovery Timeline

February 3, 2026 - CVE-2026-25488 published to NVD
February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25488

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) occurs within the administrative interface of Craft Commerce where Tax Categories are managed. Unlike reflected XSS attacks that require tricking users into clicking malicious links, stored XSS persists in the application's database and executes whenever administrators access the affected pages.

The attack requires authenticated access to the admin panel with privileges to create or modify Tax Categories. Once a malicious payload is stored in either the Name or Description field, it will execute in the browser of any administrator who subsequently views the Tax Categories section.

While the vulnerability requires high-privilege access to inject payloads, the impact can be significant as it targets administrative users who typically have full control over the ecommerce platform. The stored nature of the attack means it persists across sessions and can affect multiple administrators.

Root Cause

The root cause is insufficient output encoding when rendering user-supplied content from the Tax Categories Name and Description fields. The application fails to properly escape or sanitize this data before displaying it in the admin panel HTML context, allowing JavaScript code to be interpreted and executed by the browser rather than being displayed as harmless text.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the Craft Commerce admin panel with permissions to manage Tax Categories. The attack flow involves:

An attacker with Store Management privileges accesses the Tax Categories configuration
The attacker creates or edits a Tax Category, injecting malicious JavaScript into the Name or Description field
The payload is stored in the database without proper sanitization
When any administrator views the Tax Categories list or details, the malicious script executes in their browser
The script can then steal session tokens, perform administrative actions, or exfiltrate sensitive data

The vulnerability mechanism involves injecting JavaScript payloads into form fields that are later rendered in the admin interface without proper escaping. Common XSS payloads targeting these fields might include script tags or event handlers designed to capture administrator credentials or session tokens. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25488

Indicators of Compromise

Unusual JavaScript code or HTML tags present in Tax Category Name or Description fields in the database
Unexpected administrative actions or configuration changes not initiated by known administrators
Session token theft indicators or unusual admin account activity patterns
Browser console errors or warnings related to Content Security Policy violations in admin sessions

Detection Strategies

Implement database monitoring to alert on Tax Category records containing suspicious patterns such as <script>, javascript:, or event handlers like onerror and onload
Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in form submissions to the Store Management endpoints
Enable Content Security Policy (CSP) headers with strict-dynamic or nonce-based configurations to prevent inline script execution

Monitoring Recommendations

Review audit logs for Tax Category creation and modification events, particularly from unusual IP addresses or at unexpected times
Monitor for signs of session hijacking such as geographic anomalies or simultaneous sessions from different locations
Implement real-time alerting on any modifications to critical ecommerce settings following Tax Category access

How to Mitigate CVE-2026-25488

Immediate Actions Required

Upgrade Craft Commerce to version 4.10.1 or 5.5.2 immediately depending on your major version
Audit existing Tax Category records for any suspicious content or JavaScript payloads in Name and Description fields
Review admin access logs for unauthorized Tax Category modifications
Consider temporarily restricting Store Management permissions to essential personnel until patching is complete

Patch Information

Craft CMS has released patched versions that address this vulnerability. The fix involves properly sanitizing and encoding Tax Category Name and Description fields before rendering them in the admin panel.

Version 4.x users: Upgrade to Craft Commerce 4.10.1
Version 5.x users: Upgrade to Craft Commerce 5.5.2

The security fix can be reviewed in the GitHub commit. For complete vulnerability details, see the GitHub Security Advisory GHSA-p6w8-q63m-72c8.

Workarounds

If immediate patching is not possible, restrict admin panel access to trusted networks via IP allowlisting
Implement strict Content Security Policy headers to mitigate the impact of XSS execution
Limit Store Management permissions to the minimum number of administrators required
Manually sanitize existing Tax Category records by removing any HTML or JavaScript content from Name and Description fields

bash

# Example: Update Craft Commerce via Composer
composer require craftcms/commerce:^4.10.1  # For 4.x installations
# or
composer require craftcms/commerce:^5.5.2  # For 5.x installations

# Clear caches after update
./craft clear-caches/all