CVE-2026-25522

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

• CWE-79

• https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839eePatch
• https://github.com/craftcms/commerce/releases/tag/4.10.1Product, Release Notes
• https://github.com/craftcms/commerce/releases/tag/5.5.2Product, Release Notes
• https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9mExploit, Patch, Vendor Advisory

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25517Wagtail is an open source content management system built on…2.7
• CVE-2026-25518cert-manager adds certificates and certificate issuers as re…5.9
• CVE-2026-25519OpenSlides is a free, web based presentation and assembly sy…9.8
• CVE-2026-2552A vulnerability was identified in ZenTao up to 21.7.8. Affec…5.5
• CVE-2026-25520SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25521Locutus brings stdlibs of other programming languages to Jav…8.8
• CVE-2026-25523Magento-lts is a long-term support alternative to Magento Co…5.3
• CVE-2026-25524Magento Long Term Support (LTS) is an unofficial, community-…8.1
• CVE-2026-25525Magento Long Term Support (LTS) is an unofficial, community-…4.9
• CVE-2026-25526JinJava is a Java-based template engine based on django temp…9.8
• CVE-2026-25527changedetection.io is a free open source web page change det…5.3
• CVE-2026-25528LangSmith Client SDKs provide SDK's for interacting with the…5.8