p PatchFirst

CVE-2026-25485

CVE-2026-25485 · Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

CVSS 6.2 · Media · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • commerce

    Versiones
    • >= 4.0.0-RC1, < 4.10.1: Afectada
    • >= 5.0.0, < 5.5.2: Afectada

    Sin corrección publicada

  • craftcms/composer Packagist

    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 5.0.0-RC1, < 5.5.2

    Actualiza a 5.5.2

  • craftcms/composer Packagist

    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 4.0.0-RC1, < 4.10.1

    Actualiza a 4.10.1

Fuentes originales

Comprueba tu servidor →