{"id":"CVE-2026-25482","aliases":["EUVD-2026-5211","GHSA-frj9-9rwc-pw9j"],"status":"published","title":"Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the \"Recent Orders\" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.","severity":{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00345,"percentile":0.28333,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-02T22:41:44Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/commerce","fixed_in":["5.5.2","4.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.5.1"},{"fixed":"5.5.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"last_affected":"4.10.0"},{"fixed":"4.10.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.5.2"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.10.1","5.0.11","5.0.11.1","5.0.12","5.0.12.1","5.0.12.2","5.0.13","5.0.14","5.0.15","5.0.16","5.0.16.1","5.0.16.2","5.0.17","5.0.18","5.0.19","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-beta.1","5.1.0-beta.2","5.1.0-beta.3","5.1.0.1","5.1.1","5.1.2","5.1.3","5.1.4","5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.12.1","5.2.2","5.2.2.1","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.2.9.1","5.3.0","5.3.0.1","5.3.0.2","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.2","5.3.2.1","5.3.2.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9","5.4.0","5.4.1","5.4.1.1","5.4.10","5.4.2","5.4.3","5.4.4","5.4.5","5.4.5.1","5.4.6","5.4.7","5.4.7.1","5.4.8","5.4.9","5.5.0","5.5.0.1","5.5.1"]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.10.1"}]}],"versions":["4.0.0","4.0.0-RC1","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.1","4.1.2","4.1.3","4.10.0","4.2.0","4.2.1","4.2.10","4.2.11","4.2.2","4.2.3","4.2.4","4.2.5","4.2.5.1","4.2.6","4.2.7","4.2.8","4.2.9","4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","4.4.1","4.4.1.1","4.5.0","4.5.1","4.5.1.1","4.5.2","4.5.3","4.5.4","4.6.0","4.6.1","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.2","4.6.3.1","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.6.9","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.8.0.1","4.8.1","4.8.1.1","4.8.1.2","4.8.2","4.8.3","4.8.4","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4"]}],"products":[{"vendor":"craftcms","product":"commerce"},{"vendor":"craftcms","product":"craft_commerce"}],"references":[{"url":"https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/craftcms/commerce/releases/tag/4.10.1","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/craftcms/commerce/releases/tag/5.5.2","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25482","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-frj9-9rwc-pw9j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25482.json","tags":["advisory"]},{"url":"https://github.com/craftcms/commerce","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25482","title":"Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the \"Recent Orders\" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:05:09.783Z","modified":"2026-02-04T16:51:24.031Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-5211","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the \"Recent Orders\" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:05:09Z","modified":"2026-02-04T16:51:24Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:44.193176Z"}],"ghsa":[{"id":"GHSA-frj9-9rwc-pw9j","title":"Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)","description":"## Summary\n\nA stored DOM XSS vulnerability exists in the **\"Recent Orders\"** dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.\n\nUsers are recommended to update to the patched 5.5.2 release to mitigate the issue.\n\n---\n## Proof of Concept\n\n### Required Permissions\n\n- Admin access (to edit/create Order Statuses)\n\n### Steps to Reproduce\n1. Log in with an admin account\n2. Navigate to **Commerce** → **Settings** → **Order Statuses**\n3. Create new order status (e.g., \"Pending\")\n4. Set the **Name** field to:\n```html\n\u003cimg src=x onerror=\"alert('Order Statuses XSS')\" hidden\u003e\n```\n5. Save the order status\n6. Go to Commerce Orders \u0026 make some orders with different statuses (e.g. \"New\" \u0026 \"the malicious created status\")\n7. Go to the Dashboard (`/admin/dashboard`) \u0026 Add **\"Recent Orders\"** widget and pick the same 2 statuses for orders\n8. Notice the XSS execution \u003cimg width=\"1491\" height=\"568\" alt=\"xss-execution-in-dashboard\" src=\"https://github.com/user-attachments/assets/84e8b121-30b9-4029-93be-e90009b6897e\" /\u003e\n\n\n---\n## Technical Details\n\n**File:** `vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig`\n\n**Root Cause:** `value.name` (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.\u003cimg width=\"1780\" height=\"858\" alt=\"vulnerable-code\" src=\"https://github.com/user-attachments/assets/b150ee9d-c072-4987-b506-81a29c23d84b\" /\u003e\n\n---\n## Mitigation\nUse `Craft.escapeHtml()` in the callback:\n```javascript\ncallback: function(value) {\n    return '\u003cspan class=\"commerceStatusLabel\"\u003e\u003cspan class=\"status ' + Craft.escapeHtml(value.color) + '\"\u003e\u003c/span\u003e' + Craft.escapeHtml(value.name) + '\u003c/span\u003e';\n}\n```\n\n## Resources:\n\nhttps://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65","status":"published","published":"2026-02-02T22:41:44Z","modified":"2026-02-03T21:39:54Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-25482","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the \"Recent Orders\" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T19:16:25.563Z","modified":"2026-06-17T10:24:42.68Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25482","title":"Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the \"Recent Orders\" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:05:09.783Z","modified":"2026-10-28T02:30:43.827591405Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-frj9-9rwc-pw9j","title":"Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)","description":"## Summary\n\nA stored DOM XSS vulnerability exists in the **\"Recent Orders\"** dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.\n\nUsers are recommended to update to the patched 5.5.2 release to mitigate the issue.\n\n---\n## Proof of Concept\n\n### Required Permissions\n\n- Admin access (to edit/create Order Statuses)\n\n### Steps to Reproduce\n1. Log in with an admin account\n2. Navigate to **Commerce** → **Settings** → **Order Statuses**\n3. Create new order status (e.g., \"Pending\")\n4. Set the **Name** field to:\n```html\n\u003cimg src=x onerror=\"alert('Order Statuses XSS')\" hidden\u003e\n```\n5. Save the order status\n6. Go to Commerce Orders \u0026 make some orders with different statuses (e.g. \"New\" \u0026 \"the malicious created status\")\n7. Go to the Dashboard (`/admin/dashboard`) \u0026 Add **\"Recent Orders\"** widget and pick the same 2 statuses for orders\n8. Notice the XSS execution \u003cimg width=\"1491\" height=\"568\" alt=\"xss-execution-in-dashboard\" src=\"https://github.com/user-attachments/assets/84e8b121-30b9-4029-93be-e90009b6897e\" /\u003e\n\n\n---\n## Technical Details\n\n**File:** `vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig`\n\n**Root Cause:** `value.name` (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.\u003cimg width=\"1780\" height=\"858\" alt=\"vulnerable-code\" src=\"https://github.com/user-attachments/assets/b150ee9d-c072-4987-b506-81a29c23d84b\" /\u003e\n\n---\n## Mitigation\nUse `Craft.escapeHtml()` in the callback:\n```javascript\ncallback: function(value) {\n    return '\u003cspan class=\"commerceStatusLabel\"\u003e\u003cspan class=\"status ' + Craft.escapeHtml(value.color) + '\"\u003e\u003c/span\u003e' + Craft.escapeHtml(value.name) + '\u003c/span\u003e';\n}\n```\n\n## Resources:\n\nhttps://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65","status":"published","published":"2026-02-02T22:41:44Z","modified":"2026-02-03T21:50:01.970152Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}