GHSA-FRJ9-9RWC-PW9J

Vulnerability from github – Published: 2026-02-02 22:41 – Updated: 2026-02-03 21:39
VLAI?
Summary
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Details

Summary

A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.

Users are recommended to update to the patched 5.5.2 release to mitigate the issue.

Proof of Concept

Required Permissions

  • Admin access (to edit/create Order Statuses)

Steps to Reproduce

  1. Log in with an admin account
  2. Navigate to Commerce → Settings → Order Statuses
  3. Create new order status (e.g., "Pending")
  4. Set the Name field to:
<img src=x onerror="alert('Order Statuses XSS')" hidden>
  1. Save the order status
  2. Go to Commerce Orders & make some orders with different statuses (e.g. "New" & "the malicious created status")
  3. Go to the Dashboard (/admin/dashboard) & Add "Recent Orders" widget and pick the same 2 statuses for orders
  4. Notice the XSS execution xss-execution-in-dashboard

Technical Details

File: vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig

Root Cause: value.name (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.vulnerable-code

Mitigation

Use Craft.escapeHtml() in the callback:

callback: function(value) {
    return '<span class="commerceStatusLabel"><span class="status ' + Craft.escapeHtml(value.color) + '"></span>' + Craft.escapeHtml(value.name) + '</span>';
}

Resources:

https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65

Severity ?
6.2 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.5.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.10.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T22:41:44Z",
    "nvd_published_at": "2026-02-03T19:16:25Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA stored DOM XSS vulnerability exists in the **\"Recent Orders\"** dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.\n\nUsers are recommended to update to the patched 5.5.2 release to mitigate the issue.\n\n---\n## Proof of Concept\n\n### Required Permissions\n\n- Admin access (to edit/create Order Statuses)\n\n### Steps to Reproduce\n1. Log in with an admin account\n2. Navigate to **Commerce** \u2192 **Settings** \u2192 **Order Statuses**\n3. Create new order status (e.g., \"Pending\")\n4. Set the **Name** field to:\n```html\n\u003cimg src=x onerror=\"alert(\u0027Order Statuses XSS\u0027)\" hidden\u003e\n```\n5. Save the order status\n6. Go to Commerce Orders \u0026 make some orders with different statuses (e.g. \"New\" \u0026 \"the malicious created status\")\n7. Go to the Dashboard (`/admin/dashboard`) \u0026 Add **\"Recent Orders\"** widget and pick the same 2 statuses for orders\n8. Notice the XSS execution \u003cimg width=\"1491\" height=\"568\" alt=\"xss-execution-in-dashboard\" src=\"https://github.com/user-attachments/assets/84e8b121-30b9-4029-93be-e90009b6897e\" /\u003e\n\n\n---\n## Technical Details\n\n**File:** `vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig`\n\n**Root Cause:** `value.name` (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.\u003cimg width=\"1780\" height=\"858\" alt=\"vulnerable-code\" src=\"https://github.com/user-attachments/assets/b150ee9d-c072-4987-b506-81a29c23d84b\" /\u003e\n\n---\n## Mitigation\nUse `Craft.escapeHtml()` in the callback:\n```javascript\ncallback: function(value) {\n    return \u0027\u003cspan class=\"commerceStatusLabel\"\u003e\u003cspan class=\"status \u0027 + Craft.escapeHtml(value.color) + \u0027\"\u003e\u003c/span\u003e\u0027 + Craft.escapeHtml(value.name) + \u0027\u003c/span\u003e\u0027;\n}\n```\n\n## Resources:\n\nhttps://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65",
  "id": "GHSA-frj9-9rwc-pw9j",
  "modified": "2026-02-03T21:39:52Z",
  "published": "2026-02-02T22:41:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-frj9-9rwc-pw9j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/commit/d94d1c9832a47a1c383e375ae87c46c13935ba65"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/commerce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/releases/tag/4.10.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/releases/tag/5.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in \"Recent Orders\" Dashboard Widget)"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.