craftcms/composer vulnerabilities (Packagist)

1 vulnerability.

• craftcms/composer Packagist Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25485 Fix available 6.2 MediumFebruary 2, 2026