Every CVE Search/ Get API key

CVE-2026-25482

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

6.2 MediumFix available

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.34%Up 0.3 points since Feb 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.2

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Record
CVE-2026-25482
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-5211 6.2

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Record
EUVD-2026-5211
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-frj9-9rwc-pw9j 6.2

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary

A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.

Users are recommended to update to the patched 5.5.2 release to mitigate the issue.

Proof of Concept

Required Permissions

  • Admin access (to edit/create Order Statuses)

Steps to Reproduce

  1. Log in with an admin account
  2. Navigate to Commerce → Settings → Order Statuses
  3. Create new order status (e.g., "Pending")
  4. Set the Name field to:
<img src=x onerror="alert('Order Statuses XSS')" hidden>
  1. Save the order status
  2. Go to Commerce Orders & make some orders with different statuses (e.g. "New" & "the malicious created status")
  3. Go to the Dashboard (/admin/dashboard) & Add "Recent Orders" widget and pick the same 2 statuses for orders
  4. Notice the XSS execution <img width="1491" height="568" alt="xss-execution-in-dashboard" src="https://github.com/user-attachments/assets/84e8b121-30b9-4029-93be-e90009b6897e" />

Technical Details

File: vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig

Root Cause: value.name (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.<img width="1780" height="858" alt="vulnerable-code" src="https://github.com/user-attachments/assets/b150ee9d-c072-4987-b506-81a29c23d84b" />

Mitigation

Use Craft.escapeHtml() in the callback:

callback: function(value) {
    return '<span class="commerceStatusLabel"><span class="status ' + Craft.escapeHtml(value.color) + '"></span>' + Craft.escapeHtml(value.name) + '</span>';
}

Resources:

https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65

Record
GHSA-frj9-9rwc-pw9j
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.2

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Record
CVE-2026-25482
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.2

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Record
CVE-2026-25482
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-frj9-9rwc-pw9j 6.2

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary

A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.

Users are recommended to update to the patched 5.5.2 release to mitigate the issue.

Proof of Concept

Required Permissions

  • Admin access (to edit/create Order Statuses)

Steps to Reproduce

  1. Log in with an admin account
  2. Navigate to Commerce → Settings → Order Statuses
  3. Create new order status (e.g., "Pending")
  4. Set the Name field to:
<img src=x onerror="alert('Order Statuses XSS')" hidden>
  1. Save the order status
  2. Go to Commerce Orders & make some orders with different statuses (e.g. "New" & "the malicious created status")
  3. Go to the Dashboard (/admin/dashboard) & Add "Recent Orders" widget and pick the same 2 statuses for orders
  4. Notice the XSS execution <img width="1491" height="568" alt="xss-execution-in-dashboard" src="https://github.com/user-attachments/assets/84e8b121-30b9-4029-93be-e90009b6897e" />

Technical Details

File: vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig

Root Cause: value.name (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.<img width="1780" height="858" alt="vulnerable-code" src="https://github.com/user-attachments/assets/b150ee9d-c072-4987-b506-81a29c23d84b" />

Mitigation

Use Craft.escapeHtml() in the callback:

callback: function(value) {
    return '<span class="commerceStatusLabel"><span class="status ' + Craft.escapeHtml(value.color) + '"></span>' + Craft.escapeHtml(value.name) + '</span>';
}

Resources:

https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65

Record
GHSA-frj9-9rwc-pw9j
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/commerce
Packagist
 5.0.0 to 5.5.1
5.5.2
craftcms/commerce
Packagist
 4.0.0-RC1 to 4.10.0
4.10.1
craftcms/commerce
Packagist
 5.0.0 up to 5.5.2, plus listed versions
5.0.15.0.105.0.10.15.0.115.0.11.1
Show 45 moreShow less
5.0.125.0.12.15.0.12.25.0.135.0.145.0.155.0.165.0.16.15.0.16.25.0.175.0.185.0.195.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-beta.15.1.0-beta.25.1.0-beta.35.1.0.15.1.15.1.25.1.35.1.45.2.05.2.15.2.105.2.115.2.125.2.12.15.2.25.2.2.15.2.35.2.45.2.55.2.65.2.75.2.85.2.95.2.9.1
5.5.2
craftcms/commerce
Packagist
 4.0.0-RC1 up to 4.10.1, plus listed versions
4.0.04.0.14.0.24.0.34.0.4
Show 45 moreShow less
4.1.04.1.14.1.24.1.34.10.04.2.04.2.14.2.104.2.114.2.24.2.34.2.44.2.54.2.5.14.2.64.2.74.2.84.2.94.3.04.3.14.3.24.3.34.4.04.4.14.4.1.14.5.04.5.14.5.1.14.5.24.5.34.5.44.6.04.6.14.6.104.6.114.6.124.6.134.6.144.6.24.6.3.14.6.44.6.54.6.64.6.74.6.8
4.10.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25482 is a medium vulnerability (CVSS 6.2) in Craftcms Commerce, published February 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in craftcms/commerce 5.5.2.

References

This page doesn't list everything

Left out here: 53 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open