Junglewise Threat Intelligence

CVE-2026-25486: Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

CVE-2026-25486 · Severity: medium · CVSS 4 · Published 2026-02-02

Technologies: craftcms/commerce (Packagist). Vendors: Packagist.

Executive brief

Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Affected products

  • Packagist craftcms/commerce

Related threats