- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 20 · 5 high, 12 medium, 3 low
- Registry
- Packagist
Advisories 20
- CVE-2026-55795Medium 6.9
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Affected: from 5.0.0, fixed in 5.6.5; from 4.0.0, fixed in 4.11.2.
- CVE-2026-32272High 8.7
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
Affected: from 5.0.0, fixed in 5.6.0.
- CVE-2026-32271High 7.7
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Affected: from 4.0.0, fixed in 4.10.3; from 5.0.0, fixed in 5.5.5.
- CVE-2026-32270Low 1.7
Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
Affected: from 5.0.0, fixed in 5.6.0; from 4.0.0, fixed in 4.11.0.
- CVE-2026-31867Medium 6.3
Craft Commerce has a Potential IDOR in Commerce carts
Affected: from 5.0.0, fixed in 5.6.0; from 4.0.0, fixed in 4.11.0.
- CVE-2026-29177Low 1.9
Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3.
- CVE-2026-29176Medium 4.8
Craft Commerce has Stored XSS in Inventory Location Name
Affected: from 5.0.0, fixed in 5.5.3.
- CVE-2026-29175High 8.6
Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
Affected: from 5.0.0, fixed in 5.5.3.
- CVE-2026-29174High 8.7
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
Affected: from 5.0.0, fixed in 5.5.3.
- CVE-2026-29173Low 1.9
Craft Commerce has Stored XSS while updating Order Status from Orders Table
Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3.
- CVE-2026-29172High 8.7
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3.
- CVE-2026-25522Medium 6.1
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25490Medium 6.1
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25489Medium 6.1
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25488Medium 6.1
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
Show all 20 advisoriesShow fewer advisories
- CVE-2026-25487Medium 6.1
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25486Medium 6.1
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
Affected: from 5.0.0-RC1, fixed in 5.5.2.
- CVE-2026-25484Medium 4.8
Craft Commerce has Stored XSS in Product Type Name
Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25483Medium 6.2
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.
- CVE-2026-25482Medium 6.2
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1.