{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.5.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.10.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T23:00:13Z",
    "nvd_published_at": "2026-02-03T19:16:26Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nA stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator\u2019s browser. This occurs because the **Name \u0026 Description** fields in **Tax Zones** are not properly sanitized before being displayed in the admin panel.\n\n\n## Proof of Concept\n\n### Requirments\n- General permissions:\n\t- Access the control panel\n\t- Access Craft Commerce\n- Craft Commerce permissions:\n\t- Manage store settings\n\t- Manage taxes\n- An active administrator elevated session\n\n### Steps to Reproduce\n1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.\n2. Navigate to **Commerce** -\u003e **Store Management** -\u003e **Tax Zones** (`/admin/commerce/store-management/primary/taxzones`).\n3. Create a new tax zone.\n4. In the **Name** or **Description** field, enter the following payload:\n```html\n\u003cimg src=x onerror=\"alert(document.domain)\"\u003e\n```\n4. Click **Save** and you\u2019ll be redirected back to the previous page.\n5. Notice the alert proving JavaScript execution.\n\u003cimg width=\"1904\" height=\"418\" alt=\"poc\" src=\"https://github.com/user-attachments/assets/09bd993b-550e-40fe-b2d7-1608e25fbc01\" /\u003e\n\n### Privilege Escalation to Administrator:\n1. Do the same steps above, but replace the payload with a malicious one.\n2. The following payload elevates the attacker\u2019s account to Admin if there\u2019s already an elevated session, replace the `\u003cUserID\u003e` with your attacker id:\n3. \n```html\n\u003cimg src=x onerror=\"fetch(\u0027/admin/users/\u003cUserID\u003e/permissions\u0027,{method:\u0027POST\u0027,body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}\u0026userId=\u003cUserID\u003e\u0026admin=1\u0026action=users/save-permissions`,headers:{\u0027content-type\u0027:\u0027application/x-www-form-urlencoded\u0027}})\"\u003e\n```\n\n4. In another browser, log in as an admin \u0026 go to the vulnerable page (tax zones page).\n5. Go back to your attacker account \u0026 notice you are now an admin.\n\nThe privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim\u2019s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.\n\nOr even easier (and smarter), an attacker (using the XSS) can create a fake \u0027Session Expired\u0027 login modal overlay. Since it\u2019s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.\n\n### References:\n\nhttps://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee",
  "id": "GHSA-v585-mf6r-rqrc",
  "modified": "2026-02-03T21:40:44Z",
  "published": "2026-02-02T23:00:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25489"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/commerce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/releases/tag/4.10.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/releases/tag/5.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft Commerce has Stored XSS in Tax Zones (Name \u0026 Description) Leading to Potential Privilege Escalation"
}