Skip to content
Craftcms Commerce vulnerabilities
-
craftcms commerce-mollie
Unauthenticated payment reuse allows unpaid orders to be marked as paid
CVE-2026-115937
8.7 High
-
craftcms commerce
A privilege escalation vulnerability affects HCL Commerce
CVE-2026-21824
8.8 High
-
craftcms commerce
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
CVE-2026-55795
Fix available
6.9 Medium
-
craftcms commerce
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
CVE-2026-32272
Fix available
8.7 High
-
craftcms commerce
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
CVE-2026-32271
Fix available
7.7 High
-
craftcms commerce
Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
CVE-2026-32270
Fix available
1.7 Low
-
craftcms commerce, craft commerce +1 more
Craft Commerce has a Potential IDOR in Commerce carts
CVE-2026-31867
Fix available
6.3 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
CVE-2026-29177
Fix available
1.9 Low
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Inventory Location Name
CVE-2026-29176
Fix available
4.8 Medium
-
craftcms commerce, craft commerce +1 more
Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
CVE-2026-29175
Fix available
8.6 High
-
craftcms commerce, craft commerce +1 more
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
CVE-2026-29174
Fix available
8.7 High
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS while updating Order Status from Orders Table
CVE-2026-29173
Fix available
1.9 Low
-
craftcms commerce, craft commerce +1 more
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
CVE-2026-29172
Fix available
8.7 High
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
CVE-2026-25522
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
CVE-2026-25490
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
CVE-2026-25489
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
CVE-2026-25488
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
CVE-2026-25487
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
CVE-2026-25486
Fix available
6.1 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
CVE-2026-25485
Fix available
6.2 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS in Product Type Name
CVE-2026-25484
Fix available
4.8 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
CVE-2026-25483
Fix available
6.2 Medium
-
craftcms commerce, craft commerce +1 more
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
CVE-2026-25482
Fix available
6.2 Medium
-
craftcms commerce, hcltechsw hcl commerce +1 more
HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability
CVE-2024-23576
7.1 High
-
craftcms commerce, hcltechsw hcl commerce +1 more
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE)...
CVE-2021-27741
9.1 Critical