CVE-2026-25482 MEDIUM

CVE-2026-25482: Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Vendor Craftcms

Product commerce

Weakness CWE-79 · XSS

Published February 3, 2026

Last update February 4, 2026

View on NVD All CVEs

CVSS base score

6.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Key dates

02Disclosure timeline

February 3, 2026 CVE published

February 4, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25482 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

Identifiers

CVE CVE-2026-25482

CWE CWE-79

CVSS 6.2 / MEDIUM

Affected versions

Vendor Craftcms

Product commerce

Affected >= 5.0.0, < 5.5.2

Vendor Craftcms

Product commerce

Affected >= 4.0.0-RC1, < 4.10.1

CVE-2026-25482: Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

01Description

02Disclosure timeline

03References

04Related CVE