CVE-2026-25488
Stored XSS in Craft Commerce Tax Categories Allows Admin Browser Attack
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craftcms | craft_commerce | From 4.0.1 (inc) to 4.10.1 (exc) |
| craftcms | craft_commerce | From 5.0.0 (inc) to 5.5.2 (exc) |
| craftcms | craft_commerce | 4.0.0 |
| craftcms | craft_commerce | 4.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-25488 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce, an ecommerce platform for Craft CMS. The vulnerability exists in the Tax Categories fields (Name and Description) within the Store Management section because these fields are not properly sanitized before being displayed in the admin control panel.'}, {'type': 'paragraph', 'content': 'An attacker with access to the control panel and permissions to manage store settings and taxes can inject malicious JavaScript code into these fields. When an administrator views the affected page, the malicious script executes in their browser.'}, {'type': 'paragraph', 'content': "This can be exploited to escalate privileges by running scripts that modify the attacker's user permissions to administrator if an elevated session is active."}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows attackers to execute arbitrary JavaScript in an administrator's browser, potentially leading to privilege escalation."}, {'type': 'list_item', 'content': 'Attackers can inject scripts that elevate their user account to administrator by exploiting an active administrator session.'}, {'type': 'list_item', 'content': 'Malicious scripts can be used to manipulate the admin users API, changing permissions without authorization.'}, {'type': 'list_item', 'content': 'Attackers may automate the attack by forcing administrators to re-authenticate or use phishing techniques such as fake login modals.'}, {'type': 'paragraph', 'content': 'Overall, this can lead to unauthorized administrative access, compromising the security and integrity of the ecommerce platform.'}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to inject a malicious JavaScript payload into the Tax Categories (Name or Description) fields in the Store Management section of the Craft Commerce admin panel and observing if the script executes in an administrator's browser."}, {'type': 'list_item', 'content': 'Log into the admin panel with an account having permissions to manage store settings and taxes.'}, {'type': 'list_item', 'content': 'Navigate to Commerce → Store Management → Tax Categories.'}, {'type': 'list_item', 'content': 'Create a new tax category and insert a payload such as `<img src=x onerror="alert(document.domain)">` in the Name or Description field.'}, {'type': 'list_item', 'content': 'Save the category and check if the JavaScript alert executes, confirming the presence of the stored XSS vulnerability.'}, {'type': 'paragraph', 'content': 'There are no specific network commands provided to detect this vulnerability, as it requires interaction with the admin panel and elevated privileges.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Craft Commerce to a patched version where this vulnerability is fixed.
- Upgrade to version 4.10.1 or later if using the 4.x series.
- Upgrade to version 5.5.2 or later if using the 5.x series.
These versions include patches that properly sanitize and HTML-encode user input in the Tax Categories fields, preventing stored XSS attacks.
Additionally, restrict access to the admin panel and ensure only trusted users have permissions to manage store settings and taxes to reduce the risk of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not explicitly address how the stored XSS vulnerability in Craft Commerce impacts compliance with common standards and regulations such as GDPR or HIPAA.