MEDIUMPackagist
GHSA-2h2m-v2mg-656c· CVE-2026-25484Craft Commerce has Stored XSS in Product Type Name
Modified: 2/3/2026
package
Packagist/craftcms/commerce
pkg:packagist/craftcms/commerce
LOWPackagist
GHSA-3vxg-x5f8-f5qf· CVE-2026-32270Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
Modified: 4/14/2026
MEDIUMPackagist
GHSA-78vr-q6cf-c7p6Craft Commerce: Partial Payment Amount Without Lower Bound Validation
Modified: 9/10/2026
MEDIUMPackagist
GHSA-8478-rmjg-mjj5· CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Modified: 2/3/2026
HIGHPackagist
GHSA-875v-7m49-8x88· CVE-2026-32271Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Modified: 4/14/2026
MEDIUMPackagist
GHSA-wj89-2385-gpx3· CVE-2026-29176Craft Commerce has stored XSS in Inventory Location Name
Modified: 3/13/2026
HIGHPackagist
GHSA-cfpv-rmpf-f624· CVE-2026-29175Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
Modified: 3/13/2026
MEDIUMPackagist
GHSA-frj9-9rwc-pw9j· CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Modified: 2/3/2026
MEDIUMPackagist
GHSA-g92v-wpv7-6w22· CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
Modified: 2/22/2026
MEDIUMPackagist
GHSA-h5gm-x9wr-vhcm· CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Modified: 9/10/2026
MEDIUMPackagist
GHSA-h9r9-2pxg-cx9m· CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
Modified: 2/22/2026
HIGHPackagist
GHSA-j3x5-mghf-xvfw· CVE-2026-29172Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Modified: 3/13/2026
LOWPackagist
GHSA-mj32-r678-7mvp· CVE-2026-29177Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Modified: 3/13/2026
LOWPackagist
GHSA-mqxf-2998-c6cp· CVE-2026-29173Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Modified: 3/13/2026
MEDIUMPackagist
GHSA-p6w8-q63m-72c8· CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Modified: 2/3/2026
HIGHPackagist
GHSA-pmgj-gmm4-jh6j· CVE-2026-29174Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Modified: 3/13/2026
HIGHPackagist
GHSA-r54v-qq87-px5r· CVE-2026-32272Craft Commerce hasVariant/hasProduct Blind SQL Injection
Modified: 7/8/2026
MEDIUMPackagist
GHSA-v585-mf6r-rqrc· CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Modified: 2/22/2026
MEDIUMPackagist
GHSA-vff3-pqq8-4cpq· CVE-2026-31867Craft Commerce: Potential IDOR in Commerce carts
Modified: 3/13/2026
MEDIUMPackagist
GHSA-wq2m-r96q-crrf· CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Modified: 2/22/2026
MEDIUMPackagist
GHSA-wqc5-485v-3hqh· CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
Modified: 2/3/2026