{"id":"CVE-2026-25522","aliases":["EUVD-2026-5186","GHSA-h9r9-2pxg-cx9m"],"status":"published","title":"Craft Commerce has Stored XSS in Shipping Zone (Name \u0026 Description) Fields Leading to Potential Privilege Escalation","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00297,"percentile":0.22582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-02T23:04:00Z","modified":"2026-11-11T10:30:44Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/commerce","fixed_in":["5.5.2","4.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-RC1"},{"last_affected":"5.5.1"},{"fixed":"5.5.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"last_affected":"4.10.0"},{"fixed":"4.10.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-RC1"},{"fixed":"5.5.2"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.10.1","5.0.11","5.0.11.1","5.0.12","5.0.12.1","5.0.12.2","5.0.13","5.0.14","5.0.15","5.0.16","5.0.16.1","5.0.16.2","5.0.17","5.0.18","5.0.19","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-beta.1","5.1.0-beta.2","5.1.0-beta.3","5.1.0.1","5.1.1","5.1.2","5.1.3","5.1.4","5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.12.1","5.2.2","5.2.2.1","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.2.9.1","5.3.0","5.3.0.1","5.3.0.2","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.2","5.3.2.1","5.3.2.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9","5.4.0","5.4.1","5.4.1.1","5.4.10","5.4.2","5.4.3","5.4.4","5.4.5","5.4.5.1","5.4.6","5.4.7","5.4.7.1","5.4.8","5.4.9","5.5.0","5.5.0.1","5.5.1"]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.10.1"}]}],"versions":["4.0.0","4.0.0-RC1","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.1","4.1.2","4.1.3","4.10.0","4.2.0","4.2.1","4.2.10","4.2.11","4.2.2","4.2.3","4.2.4","4.2.5","4.2.5.1","4.2.6","4.2.7","4.2.8","4.2.9","4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","4.4.1","4.4.1.1","4.5.0","4.5.1","4.5.1.1","4.5.2","4.5.3","4.5.4","4.6.0","4.6.1","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.2","4.6.3.1","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.6.9","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.8.0.1","4.8.1","4.8.1.1","4.8.1.2","4.8.2","4.8.3","4.8.4","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4"]}],"products":[{"vendor":"craftcms","product":"commerce"},{"vendor":"craftcms","product":"craft_commerce"}],"references":[{"url":"https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/craftcms/commerce/releases/tag/4.10.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/craftcms/commerce/releases/tag/5.5.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25522","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h9r9-2pxg-cx9m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25522.json","tags":["advisory"]},{"url":"https://github.com/craftcms/commerce","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25522","title":"Craft Commerce has Stored XSS in Shipping Zone (Name \u0026 Description) Fields Leading to Potential Privilege Escalation","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:10:33.911Z","modified":"2026-02-03T19:22:34.78Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5186","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:10:33Z","modified":"2026-02-03T19:22:34Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:44.612436Z"}],"ghsa":[{"id":"GHSA-h9r9-2pxg-cx9m","title":"Craft Commerce has Stored XSS in Shipping Zone (Name \u0026 Description) Fields Leading to Potential Privilege Escalation","description":"## Summary\nA stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel.\n\n---\n## Proof of Concept\n\n### Requirments\n- General permissions:\n\t- Access the control panel\n\t- Access Craft Commerce\n- Craft Commerce permissions:\n\t- Manage store settings\n\t- Manage shipping\n- An active administrator elevated session\n\n### Steps to Reproduce\n\n1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.\n2. Navigate to **Commerce** -\u003e **Store Management** -\u003e **Shipping Zones** (`/admin/commerce/store-management/primary/shippingzones`).\n3. Create a new shipping zone.\n4. In the **Name** field, enter the following payload:\n```html\n\u003cimg src=x onerror=\"alert(document.domain)\"\u003e\n```\n4. Click **Save** \u0026 Go back to the previous page.\n5. Notice the alert proving JavaScript execution.\n\n\n### Privilege Escalation to Administrator:\n1. Do the same steps above, but replace the payload with a malicious one.\n2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `\u003cUserID\u003e` with the attacker id:\n```html\n\u003cimg src=x onerror=\"fetch('/admin/users/\u003cUserID\u003e/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}\u0026userId=\u003cUserID\u003e\u0026admin=1\u0026action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})\"\u003e\n```\n3. In another browser, log in as an admin \u0026 go to the vulnerable page (shipping zones page).\n4. Go back to the attacker account \u0026 notice it is now an admin.\n\nThe privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.\n\nOr even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.\n\n### Resources:\n\nhttps://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee","status":"published","published":"2026-02-02T23:04:00Z","modified":"2026-02-03T21:40:59Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-25522","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T19:16:27.29Z","modified":"2026-06-17T10:24:47.227Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25522","title":"Craft Commerce has Stored XSS in Shipping Zone (Name \u0026 Description) Fields Leading to Potential Privilege Escalation","description":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.","status":"published","published":"2026-02-03T18:10:33.911Z","modified":"2026-11-11T10:30:44.54035914Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T11:06:42.68927Z"},{"id":"GHSA-h9r9-2pxg-cx9m","title":"Craft Commerce has Stored XSS in Shipping Zone (Name \u0026 Description) Fields Leading to Potential Privilege Escalation","description":"## Summary\nA stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name \u0026 Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel.\n\n---\n## Proof of Concept\n\n### Requirments\n- General permissions:\n\t- Access the control panel\n\t- Access Craft Commerce\n- Craft Commerce permissions:\n\t- Manage store settings\n\t- Manage shipping\n- An active administrator elevated session\n\n### Steps to Reproduce\n\n1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.\n2. Navigate to **Commerce** -\u003e **Store Management** -\u003e **Shipping Zones** (`/admin/commerce/store-management/primary/shippingzones`).\n3. Create a new shipping zone.\n4. In the **Name** field, enter the following payload:\n```html\n\u003cimg src=x onerror=\"alert(document.domain)\"\u003e\n```\n4. Click **Save** \u0026 Go back to the previous page.\n5. Notice the alert proving JavaScript execution.\n\n\n### Privilege Escalation to Administrator:\n1. Do the same steps above, but replace the payload with a malicious one.\n2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `\u003cUserID\u003e` with the attacker id:\n```html\n\u003cimg src=x onerror=\"fetch('/admin/users/\u003cUserID\u003e/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}\u0026userId=\u003cUserID\u003e\u0026admin=1\u0026action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})\"\u003e\n```\n3. In another browser, log in as an admin \u0026 go to the vulnerable page (shipping zones page).\n4. Go back to the attacker account \u0026 notice it is now an admin.\n\nThe privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.\n\nOr even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.\n\n### Resources:\n\nhttps://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee","status":"published","published":"2026-02-02T23:04:00Z","modified":"2026-02-22T23:24:34.463619Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}