CVE-2026-25483

Katalog CVE

CVSS 5.4 · Medium EPSS 0,44%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada craftcms craft commerce. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5 exploit · patch · advisory vendor
• https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c patch
• https://github.com/craftcms/commerce/releases/tag/4.10.1 release notes
• https://github.com/craftcms/commerce/releases/tag/5.5.2 release notes