# craftcms/commerce (Packagist) vulnerabilities 20 known vulnerabilities (5 high, 12 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/craftcms/commerce ## Advisories (20) ### [CVE-2026-55795](https://cve.now/CVE-2026-55795): Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass - Severity: Medium 6.9 - Published: Sep 14, 2026 - Affected: from 5.0.0, fixed in 5.6.5; from 4.0.0, fixed in 4.11.2. ### [CVE-2026-32272](https://cve.now/CVE-2026-32272): Craft Commerce: Blind SQL Injection via hasVariant/hasProduct - Severity: High 8.7 - Published: Apr 13, 2026 - Affected: from 5.0.0, fixed in 5.6.0. ### [CVE-2026-32271](https://cve.now/CVE-2026-32271): Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget - Severity: High 7.7 - Published: Apr 13, 2026 - Affected: from 4.0.0, fixed in 4.10.3; from 5.0.0, fixed in 5.5.5. ### [CVE-2026-32270](https://cve.now/CVE-2026-32270): Craft Commerce: Unauthenticated information disclosure in \`commerce/payments/pay\` can leak some customer order data on anonymous payments - Severity: Low 1.7 - Published: Apr 13, 2026 - Affected: from 5.0.0, fixed in 5.6.0; from 4.0.0, fixed in 4.11.0. ### [CVE-2026-31867](https://cve.now/CVE-2026-31867): Craft Commerce has a Potential IDOR in Commerce carts - Severity: Medium 6.3 - Published: Mar 11, 2026 - Affected: from 5.0.0, fixed in 5.6.0; from 4.0.0, fixed in 4.11.0. ### [CVE-2026-29177](https://cve.now/CVE-2026-29177): Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout - Severity: Low 1.9 - Published: Mar 10, 2026 - Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3. ### [CVE-2026-29176](https://cve.now/CVE-2026-29176): Craft Commerce has Stored XSS in Inventory Location Name - Severity: Medium 4.8 - Published: Mar 10, 2026 - Affected: from 5.0.0, fixed in 5.5.3. ### [CVE-2026-29175](https://cve.now/CVE-2026-29175): Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking - Severity: High 8.6 - Published: Mar 10, 2026 - Affected: from 5.0.0, fixed in 5.5.3. ### [CVE-2026-29174](https://cve.now/CVE-2026-29174): Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting - Severity: High 8.7 - Published: Mar 10, 2026 - Affected: from 5.0.0, fixed in 5.5.3. ### [CVE-2026-29173](https://cve.now/CVE-2026-29173): Craft Commerce has Stored XSS while updating Order Status from Orders Table - Severity: Low 1.9 - Published: Mar 10, 2026 - Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3. ### [CVE-2026-29172](https://cve.now/CVE-2026-29172): Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting - Severity: High 8.7 - Published: Mar 10, 2026 - Affected: from 4.0.0, fixed in 4.10.2; from 5.0.0, fixed in 5.5.3. ### [CVE-2026-25522](https://cve.now/CVE-2026-25522): Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25490](https://cve.now/CVE-2026-25490): Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25489](https://cve.now/CVE-2026-25489): Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25488](https://cve.now/CVE-2026-25488): Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25487](https://cve.now/CVE-2026-25487): Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25486](https://cve.now/CVE-2026-25486): Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation - Severity: Medium 6.1 - Published: Feb 3, 2026 - Affected: from 5.0.0-RC1, fixed in 5.5.2. ### [CVE-2026-25484](https://cve.now/CVE-2026-25484): Craft Commerce has Stored XSS in Product Type Name - Severity: Medium 4.8 - Published: Feb 3, 2026 - Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25483](https://cve.now/CVE-2026-25483): Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration - Severity: Medium 6.2 - Published: Feb 3, 2026 - Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. ### [CVE-2026-25482](https://cve.now/CVE-2026-25482): Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) - Severity: Medium 6.2 - Published: Feb 3, 2026 - Affected: from 5.0.0, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.10.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/craftcms/commerce Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.