VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Feb 3, 2026· Updated Feb 4, 2026

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

CVE-2026-25482

Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
craftcms/commercePackagist
>= 5.0.0, < 5.5.25.5.2
craftcms/commercePackagist
>= 4.0.0-RC1, < 4.10.14.10.1

Affected products

1

Patches

1
d94d1c9832a4

Fix encoding

https://github.com/craftcms/commerceLuke HolderDec 30, 2025via ghsa
commit
1 file changed · +1 −1
  • src/templates/_components/widgets/orders/recent/body.twig+1 −1 modified
    @@ -28,7 +28,7 @@ var columns = [
         return '';
       }
 
-      return '<span class="commerceStatusLabel"><span class="status ' + value.color + '"></span>' + value.name + '</span>';
+      return '<span class="commerceStatusLabel"><span class="status ' + value.color + '"></span>' + Craft.escapeHtml(value.name) + '</span>';
     } },
     {% endif %}
     { name: 'paid', title: Craft.escapeHtml(Craft.t('commerce', 'Total Paid')) },

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.