Medium
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Type: advisorySources: OSV
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-25490
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 17:06 UTC · Revision 1
Source evidence
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
core-osv · Original sourcePublished 3 Feb 2026, 18:09 UTC
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
osv:CVE-2026-25490
Complete source record
{
"id": "be0d5a2287fe69d2767a62702bf671ef2bcee67f451bfe79b051e8f82169a887",
"url": "https://osv.dev/vulnerability/CVE-2026-25490",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation",
"summary": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.",
"evidence": "osv:CVE-2026-25490",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-25490",
"aliases": [
"CVE-2026-25490",
"GHSA-wq2m-r96q-crrf"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/craftcms/commerce",
"type": "GIT",
"events": [
{
"introduced": "84e40b7a3d729061a7104e0242ffbf2777fa5868"
},
{
"fixed": "dc3642f0cf0695b319bd1b7aade6d9f0cc9c4e55"
},
{
"introduced": "266ccfd800264c4a0a7c22447112c097b0af7bae"
},
{
"fixed": "fb12a9fde8927af50198ea5f190d20753a8510d5"
},
{
"introduced": "03fe68b8a09d05b028c510411b55af6cea6a089a"
},
{
"fixed": "fa273330807807d05b564d37c88654cd772839ee"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*",
"range": [
{
"introduced": "4.0.1"
},
{
"fixed": "4.10.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.5.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:*",
"range": [
{
"introduced": "4.0.0-NA"
},
{
"last_affected": "4.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:*",
"range": [
{
"introduced": "4.0.0-rc1"
},
{
"last_affected": "4.0.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "fa273330807807d05b564d37c88654cd772839ee"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "dc3642f0cf0695b319bd1b7aade6d9f0cc9c4e55"
}
],
"source": "REFERENCES_TAG",
"original_tag": "4.10.1"
},
{
"range": [
{
"fixed": "fb12a9fde8927af50198ea5f190d20753a8510d5"
}
],
"source": "REFERENCES_TAG",
"original_tag": "5.5.2"
}
]
}
}
],
"versions": [
"4.0.0-NA",
"4.0.0-rc1",
"5.5.1",
"5.5.0.1",
"5.5.0",
"5.4.10",
"5.4.9",
"5.4.8",
"5.4.7.1",
"5.4.7",
"5.4.6",
"5.4.5.1",
"5.4.5",
"5.4.4",
"5.4.3",
"5.4.2",
"5.4.1.1",
"5.4.1",
"5.4.0",
"5.3.13",
"5.3.12",
"5.3.11",
"5.3.10",
"5.3.8",
"5.3.7",
"5.3.6",
"5.3.5",
"5.3.4",
"5.3.3",
"5.3.2.2",
"5.3.2.1",
"5.3.2",
"5.3.1",
"5.3.0.2",
"5.3.0.1",
"5.3.0",
"5.2.12.1",
"5.2.12",
"5.2.11",
"5.2.10",
"5.2.9.1",
"5.2.9",
"5.2.8",
"5.2.5",
"5.2.4",
"5.2.3",
"5.2.2.1",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.0.1",
"5.1.0",
"5.0.19",
"5.0.18",
"5.0.17",
"5.0.16.2",
"5.0.16.1",
"5.0.16",
"5.0.15",
"5.0.14",
"5.0.11",
"5.0.13",
"5.0.12.1",
"5.0.12",
"5.0.11.1",
"5.0.10.1",
"5.0.10",
"5.0.9",
"5.0.8",
"5.0.7",
"5.0.6",
"5.0.5",
"5.0.4",
"5.0.3",
"5.0.2",
"5.0.1",
"5.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25490.json"
}
}
],
"modified": "2026-10-28T02:30:21.430515671Z",
"provider": "osv",
"references": [
"https://github.com/craftcms/commerce/releases/tag/4.10.1",
"https://github.com/craftcms/commerce/releases/tag/5.5.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25490.json",
"https://github.com/craftcms/commerce/security/advisories/GHSA-wq2m-r96q-crrf",
"https://nvd.nist.gov/vuln/detail/CVE-2026-25490",
"https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25490.json"
}
},
"related_cves": [
{
"value": "CVE-2026-25490",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 487540,
"published_at": "2026-02-03T18:09:33.29+00:00"
}