CVE-2026-25522
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Craft Commerce allows attackers to inject malicious JavaScript into Shipping Zone fields. When administrators view these fields in the admin panel, the malicious code executes in their browsers. This affects Craft Commerce versions 4.0.0-RC1 through 4.10.0 and versions 5.0.0 through 5.5.1.
💻 Affected Systems
- Craft Commerce
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could hijack administrator sessions, steal credentials, perform administrative actions on behalf of the admin, or pivot to deeper system compromise.
Likely Case
Attackers with access to create/modify shipping zones could execute JavaScript in admin browsers, potentially stealing session cookies or performing limited administrative actions.
If Mitigated
With proper input validation and output encoding, the malicious payload would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated access to modify shipping zones. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.1 or 5.5.2
Vendor Advisory: https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m
Restart Required: No
Instructions:
1. Identify your Craft Commerce version. 2. If using version 4.x, upgrade to 4.10.1 or later. 3. If using version 5.x, upgrade to 5.5.2 or later. 4. Update via Composer: composer update craftcms/commerce. 5. Clear caches if necessary.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom validation to sanitize Shipping Zone Name and Description fields before storage
Implement server-side validation to strip/escape HTML/JavaScript from shipping zone fields
🧯 If You Can't Patch
- Restrict access to shipping zone management to only essential administrators
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check Craft Commerce version in admin panel or via composer show craftcms/commerceCheck Version:
composer show craftcms/commerce | grep versionsVerify Fix Applied:
Verify version is 4.10.1+ or 5.5.2+ and test that HTML/JavaScript in shipping zone fields displays as text not executable code📡 Detection & Monitoring
Log Indicators:
- Unusual shipping zone modifications
- Administrator account performing unexpected actions
Network Indicators:
- Suspicious outbound connections from admin panel sessions
SIEM Query:
Search for shipping zone creation/modification events followed by unusual admin activity