CVE-2026-25484: Craft Commerce has Stored XSS in Product Type Name

Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 23% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CO

commerce · craftcms

>= 4.0.0-RC1, < 4.10.1; >= 5.0.0, < 5.5.2 · source: vendor

CC

Craft Commerce · Craftcms

4.0.1 before 4.10.1; 5.0.0 before 5.5.2; 4.0.0; 4.0.0 · source: NVD