# CVE-2026-25522: commerce XSS — Fixed in 5.5.2 🐘 Packagist Not in CISA KEV # CVE-2026-25522 — commerce [Fix: craftcms/commerce@fa27333](https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee) CVE-2026-25522 is a Cross-site Scripting (XSS) vulnerability in craftcms/commerce. A fix is available for craftcms/commerce — see the affected versions and patch details below. Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation Also known as[GHSA-h9r9-2pxg-cx9m](/vulnerability/GHSA-h9r9-2pxg-cx9m) Published Feb 3, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25522. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs22th percentile — riskier than 22% of all scored CVEsHighest risk 0.00%0.28%0.57%0.85%0.0%0.3%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected 🐘`craftcms/commerce`🐘`craftcms/commerce` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description ### Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel. * * * ### Proof of Concept #### Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage shipping - An active administrator elevated session #### Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to **Commerce** -> **Store Management** -> **Shipping Zones** (`/admin/commerce/store-management/primary/shippingzones`). 3. Create a new shipping zone. 4. In the **Name** field, enter the following payload: ```

``` 1. Click **Save** & Go back to the previous page. 2. Notice the alert proving JavaScript execution. #### Privilege Escalation to Administrator: 1. Do the same steps above, but replace the payload with a malicious one. 2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `` with the attacker id: ```

``` 1. In another browser, log in as an admin & go to the vulnerable page (shipping zones page). 2. Go back to the attacker account & notice it is now an admin. The privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack. Or even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker. #### Resources: [https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee](https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee) ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `craftcms/commerce` ≥ 5.0.0-RC1&&< 5.5.2 5.5.2`composer require craftcms/commerce:^5.5.2` 🐘Packagist `craftcms/commerce` ≥ 4.0.0-RC1&&< 4.10.1 4.10.1`composer require craftcms/commerce:^4.10.1` ## Affected Products 1 product · 2 configurations Application `craft commerce`craftcms ≥ 5.0.0 && < 5.5.2 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/commerce, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update craftcms/commerce to 5.5.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25522 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions \## Summary A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the \*\*Store Management\*\* section are not properly sanitized before being displayed in the admin panel. --- ## Proof of Concept ### Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage shipping - An active administrator elevated session ### Steps to Reproduce 1. Log in to the Admin Panel wit O3 Security · Impact-Aware SCA ### Is CVE-2026-25522 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)