Craftcms Craft Commerce vulnerabilities

• craftcms commerce, craft commerce +1 more Craft Commerce has a Potential IDOR in Commerce carts CVE-2026-31867 Fix available 6.3 MediumMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout CVE-2026-29177 Fix available 1.9 LowMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Inventory Location Name CVE-2026-29176 Fix available 4.8 MediumMarch 10, 2026
• craftcms commerce, craft commerce +1 more Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVE-2026-29175 Fix available 8.6 HighMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting CVE-2026-29174 Fix available 8.7 HighMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS while updating Order Status from Orders Table CVE-2026-29173 Fix available 1.9 LowMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVE-2026-29172 Fix available 8.7 HighMarch 10, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25522 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVE-2026-25490 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVE-2026-25489 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25488 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVE-2026-25487 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation CVE-2026-25486 Fix available 6.1 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25485 Fix available 6.2 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS in Product Type Name CVE-2026-25484 Fix available 4.8 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration CVE-2026-25483 Fix available 6.2 MediumFebruary 2, 2026
• craftcms commerce, craft commerce +1 more Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) CVE-2026-25482 Fix available 6.2 MediumFebruary 2, 2026