Security
فارسی
All products

craftcms/commerce

Composer · Package
21 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Craft Commerce: Coupon Code Brute-Force via Rate Limit BypassCVE-2026-55795 · GHSA-H5GM-X9WR-VHCM craftcms/commerce Composer Medium Fix reported
Craft Commerce: Partial Payment Amount Without Lower Bound ValidationGHSA-78VR-Q6CF-C7P6 craftcms/commerce Composer Medium Fix reported
Craft Commerce hasVariant/hasProduct Blind SQL InjectionCVE-2026-32272 · GHSA-R54V-QQ87-PX5R craftcms/commerce Composer High Fix reported
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous paymentsCVE-2026-32270 · GHSA-3VXG-X5F8-F5QF craftcms/commerce Composer Low Fix reported
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetCVE-2026-32271 · GHSA-875V-7M49-8X88 craftcms/commerce Composer High Fix reported
Craft Commerce: Potential IDOR in Commerce cartsCVE-2026-31867 · GHSA-VFF3-PQQ8-4CPQ craftcms/commerce Composer Medium Fix reported
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders TableCVE-2026-29173 · GHSA-MQXF-2998-C6CP craftcms/commerce Composer Low Fix reported
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session HijackingCVE-2026-29175 · GHSA-CFPV-RMPF-F624 craftcms/commerce Composer High Fix reported
Craft Commerce has stored XSS in Inventory Location NameCVE-2026-29176 · GHSA-WJ89-2385-GPX3 craftcms/commerce Composer Medium Fix reported
Craft Commerce has stored XSS in Craft Commerce Order Details SlideoutCVE-2026-29177 · GHSA-MJ32-R678-7MVP craftcms/commerce Composer Low Fix reported
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table SortingCVE-2026-29174 · GHSA-PMGJ-GMM4-JH6J craftcms/commerce Composer High Fix reported
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table SortingCVE-2026-29172 · GHSA-J3X5-MGHF-XVFW craftcms/commerce Composer High Fix reported
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege EscalationCVE-2026-25490 · GHSA-WQ2M-R96Q-CRRF craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege EscalationCVE-2026-25489 · GHSA-V585-MF6R-RQRC craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege EscalationCVE-2026-25522 · GHSA-H9R9-2PXG-CX9M craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege EscalationCVE-2026-25486 · GHSA-G92V-WPV7-6W22 craftcms/commerce Composer Medium Fix reported
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege EscalationCVE-2026-25487 · GHSA-WQC5-485V-3HQH craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationCVE-2026-25488 · GHSA-P6W8-Q63M-72C8 craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)CVE-2026-25482 · GHSA-FRJ9-9RWC-PW9J craftcms/commerce Composer Medium Fix reported
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltrationCVE-2026-25483 · GHSA-8478-RMJG-MJJ5 craftcms/commerce Composer Medium Fix reported