CVE-2026-25483

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25483", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T16:31:35.821Z", "datePublished": "2026-02-03T18:05:49.411Z", "dateUpdated": "2026-02-04T16:51:19.008Z"}, "containers": {"cna": {"title": "Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5"}, {"name": "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c", "tags": ["x_refsource_MISC"], "url": "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c"}, {"name": "https://github.com/craftcms/commerce/releases/tag/4.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/craftcms/commerce/releases/tag/4.10.1"}, {"name": "https://github.com/craftcms/commerce/releases/tag/5.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/craftcms/commerce/releases/tag/5.5.2"}], "affected": [{"vendor": "craftcms", "product": "commerce", "versions": [{"version": ">= 4.0.0-RC1, < 4.10.1", "status": "affected"}, {"version": ">= 5.0.0, < 5.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T18:05:49.411Z"}, "descriptions": [{"lang": "en", "value": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce\u2019s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2."}], "source": {"advisory": "GHSA-8478-rmjg-mjj5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:46:22.023688Z", "id": "CVE-2026-25483", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:51:19.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25483", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:46:22.023688Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:46:23.252Z"}}], "cna": {"title": "Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration", "source": {"advisory": "GHSA-8478-rmjg-mjj5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "craftcms", "product": "commerce", "versions": [{"status": "affected", "version": ">= 4.0.0-RC1, < 4.10.1"}, {"status": "affected", "version": ">= 5.0.0, < 5.5.2"}]}], "references": [{"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5", "name": "https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c", "name": "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/craftcms/commerce/releases/tag/4.10.1", "name": "https://github.com/craftcms/commerce/releases/tag/4.10.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/craftcms/commerce/releases/tag/5.5.2", "name": "https://github.com/craftcms/commerce/releases/tag/5.5.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce\u2019s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T18:05:49.411Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25483", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:51:19.008Z", "dateReserved": "2026-02-02T16:31:35.821Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T18:05:49.411Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "commerce", "vendor": "craftcms", "versions": [{"status": "affected", "version": ">= 4.0.0-RC1, < 4.10.1"}, {"status": "affected", "version": ">= 5.0.0, < 5.5.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*", "matchCriteriaId": "6EFA9347-254D-4D9E-84B1-8C0FFCC377F9", "versionEndExcluding": "4.10.1", "versionStartIncluding": "4.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*", "matchCriteriaId": "65ADAE4B-A19C-4FB1-AE39-8CF4AF57499B", "versionEndExcluding": "5.5.2", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:*", "matchCriteriaId": "2B409639-1C00-4E9C-950E-77058C40A5F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:*", "matchCriteriaId": "E4B4BB43-0D60-4F6F-9F6F-1F7B3AF75EBA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce\u2019s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2."}, {"lang": "es", "value": "Craft Commerce es una plataforma de comercio electr\u00f3nico para Craft CMS. En las versiones desde la 4.0.0-RC1 hasta la 4.10.0 y desde la 5.0.0 hasta la 5.5.1, existe una vulnerabilidad de XSS almacenado en el Mensaje de Historial de Estado de Pedido de Craft Commerce. El mensaje se renderiza usando el filtro |md, que permite HTML sin procesar, posibilitando la ejecuci\u00f3n de scripts maliciosos. Si un usuario tiene permisos de utilidad de copia de seguridad de la base de datos (que no requieren una sesi\u00f3n elevada), un atacante puede exfiltrar la base de datos completa, incluyendo todas las credenciales de usuario, PII del cliente, historial de pedidos y c\u00f3digos de recuperaci\u00f3n 2FA. Este problema ha sido parcheado en las versiones 4.10.1 y 5.5.2."}], "id": "CVE-2026-25483", "lastModified": "2026-06-17T10:24:42.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25483", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:46:22.023688Z", "version": "2.0.3"}}]}, "published": "2026-02-03T19:16:25.717", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/craftcms/commerce/releases/tag/4.10.1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/craftcms/commerce/releases/tag/5.5.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:13:57.432264+00:00", "value": {"mitigation_remediation": ["Upgrade Craft Commerce to version\u202f4.10.1 or newer, or 5.5.2 or newer; this resolves the stored XSS and the backup\u2011utility exploitation path.", "If an upgrade is not yet possible, configure the CMS to sanitize or strip HTML from order status messages, effectively disabling the |md filter functionality for that field.", "Review and revoke database backup\u2011utility permissions for any roles that do not require it, reducing the impact window for potential data exfiltration."], "summary": {"action": "Purge now", "impact": "Stored XSS with potential database exfiltration"}, "threat_synthesis": {"affected_systems": "Affected products are Craft CMS Commerce from the 4.x series (4.0.0\u2011RC1 to 4.10.0) and from the 5.x series (5.0.0 to 5.5.1). The vulnerability is resolved in releases 4.10.1 and 5.5.2.", "description_and_impact": "Craft Commerce exposes a stored cross\u2011site scripting flaw in the Order Status History Message. The message is processed with the |md filter, which accepts raw HTML, so a malicious script can be embedded and executed whenever the message is viewed in a browser. This can compromise user credentials, customer personal data, order history, and even two\u2011factor recovery codes if the attacker also has backup\u2011utility permissions. The vulnerability represents a moderate severity threat; the script execution alone allows session hijacking and data theft, while the added backup\u2011utility access enables full database exfiltration.", "risk_and_exploitability": "The CVSS score is 6.2 and the EPSS is below 1\u202f%, indicating a moderate technical severity but a low likelihood of observed exploitation. The flaw can be exploited by any authenticated user able to edit order status messages, even without elevated permissions, and a separate prerequisite\u2014holding the database backup utility permission\u2014enables the attacker to extract the entire database. Because the attack requires authenticated access to the backend, the risk depends on the organization\u2019s role\u2011based access controls."}}}}, "created": "2026-02-04T12:08:42.524676+00:00", "updated": "2026-04-18T00:15:31.796274+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$commerce"]}