Beveiligingsadvies

CVE-2026-25489

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-03 18:07:40

Laatst bijgewerkt 2026-02-03 20:34:09

Toegewezen door GitHub_M

CVSS-score 6.1

Status PUBLISHED

Beschrijving

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.

← Alle CVE's bekijken Bekijk op cve.org ↗