CVE-2026-25522: Craft Commerce Stored XSS Vulnerability

CVE-2026-25522 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Craft Commerce, the popular ecommerce platform for Craft CMS. This security flaw allows attackers to execute malicious JavaScript code within an administrator's browser by exploiting insufficient input sanitization in the Store Management section.

The vulnerability exists because the Shipping Zone Name and Description fields do not properly sanitize user-supplied input before rendering it in the admin panel. An attacker with access to modify shipping zone configurations can inject malicious scripts that execute when other administrators view the affected pages.

Critical Impact
Attackers can execute arbitrary JavaScript in administrator browsers, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or further compromise of the Craft CMS installation.

Affected Products

Craft Commerce versions 4.0.0-RC1 through 4.10.0
Craft Commerce versions 5.0.0 through 5.5.1
Craft CMS installations utilizing vulnerable Craft Commerce versions

Discovery Timeline

2026-02-03 - CVE-2026-25522 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25522

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) occurs in the Craft Commerce admin panel's Store Management section. When administrators configure shipping zones, the Name and Description fields accept user input that is stored in the database and later rendered in the admin interface without proper output encoding or sanitization.

The vulnerability requires an attacker to have privileged access to the Craft Commerce admin panel with permissions to modify shipping zone configurations. Once malicious JavaScript is injected into a shipping zone field, it persists in the database and executes in the browser context of any administrator who subsequently views the shipping zones list or details page.

This type of stored XSS is particularly dangerous because the malicious payload remains active until the affected record is modified or removed, potentially impacting multiple administrator sessions over time.

Root Cause

The root cause of CVE-2026-25522 is improper output encoding in the Craft Commerce admin panel templates. When rendering shipping zone Name and Description fields, the application fails to escape special HTML characters before inserting user-controlled data into the page DOM. This allows attackers to break out of the intended text context and inject executable script elements.

The fix implemented in versions 4.10.1 and 5.5.2 ensures proper HTML entity encoding is applied to shipping zone field values before they are displayed in the admin interface.

Attack Vector

The attack vector is network-based and requires authenticated access to the Craft Commerce admin panel with shipping zone management privileges. An attacker would:

Authenticate to the Craft Commerce admin panel
Navigate to Store Management → Shipping → Shipping Zones
Create or edit a shipping zone
Insert malicious JavaScript payload in the Name or Description field
Save the shipping zone configuration

When other administrators view the shipping zones section, the injected script executes in their browser context with full access to the admin session, enabling actions such as stealing session cookies, performing CSRF attacks, or modifying site content.

The vulnerability can be exploited using standard XSS payloads embedded in the shipping zone fields. Technical details are available in the GitHub Security Advisory GHSA-h9r9-2pxg-cx9m.

Detection Methods for CVE-2026-25522

Indicators of Compromise

Presence of <script> tags or JavaScript event handlers in shipping zone database records
Unusual JavaScript execution errors in browser console when viewing shipping zone pages
Shipping zone Name or Description fields containing encoded script elements or event attributes
Administrator session cookies being transmitted to external domains

Detection Strategies

Implement Content Security Policy (CSP) headers to detect and block inline script execution
Monitor database records for shipping zones containing suspicious HTML or JavaScript patterns
Review admin panel access logs for unusual shipping zone modification activity
Deploy browser-based XSS detection tools in administrator environments

Monitoring Recommendations

Enable audit logging for all Craft Commerce admin panel configuration changes
Implement real-time alerting for database modifications to shipping-related tables
Monitor outbound network traffic from administrator workstations for data exfiltration patterns
Conduct periodic security scans of stored content for XSS payload signatures

How to Mitigate CVE-2026-25522

Immediate Actions Required

Update Craft Commerce to version 4.10.1 or 5.5.2 immediately
Audit existing shipping zone records for malicious JavaScript content
Review admin panel access logs for unauthorized shipping zone modifications
Invalidate and regenerate all administrator session tokens as a precaution

Patch Information

Craft CMS has released patched versions that address this vulnerability through proper output encoding of shipping zone fields:

Craft Commerce 4.x: Update to version 4.10.1 or later
Craft Commerce 5.x: Update to version 5.5.2 or later

The security fix is documented in commit fa273330807807d05b564d37c88654cd772839ee. For complete vulnerability details, refer to the GitHub Security Advisory GHSA-h9r9-2pxg-cx9m.

Workarounds

Restrict shipping zone management permissions to only essential trusted administrators
Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in form submissions
Deploy Content Security Policy headers with strict script-src directives to mitigate XSS impact
Manually sanitize existing shipping zone records by removing any HTML or JavaScript content

bash

# Update Craft Commerce via Composer
composer require craftcms/commerce:^4.10.1
# or for version 5.x
composer require craftcms/commerce:^5.5.2

# Clear Craft CMS caches after update
php craft clear-caches/all