CVE-2026-25482: 
PHP vulnerability analysis and mitigation

CVE-2026-25482 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS. The flaw exists in the "Recent Orders" dashboard widget, where the Order Status Name is rendered via JavaScript string concatenation without proper HTML escaping, enabling script execution in any admin's browser upon visiting the dashboard. Affected versions include Craft Commerce 4.0.0-RC1 through 4.10.0 and 5.0.0 through 5.5.1. It was disclosed on February 2, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.2 (Medium) (Github Advisory, Craft Commerce Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored DOM XSS pattern. In the file vendor/craftcms/commerce/src/templates/_components/widgets/orders/recent/body.twig, the value.name field (the Order Status Name) is directly concatenated into an HTML string within a JavaScript callback — return '' + value.name + ''; — without any sanitization or escaping. When the browser's JavaScript engine inserts this string into the DOM, any embedded HTML or script tags in the Order Status Name are executed. Exploitation requires an attacker to have admin-level access to create or edit Order Statuses, and the payload triggers automatically when any admin visits the dashboard with the "Recent Orders" widget configured (Craft Commerce Advisory, Fix Commit).

Successful exploitation allows an attacker with admin access to store a malicious script payload in an Order Status Name that executes in the browser context of any other admin who visits the dashboard. This can lead to session token theft, credential harvesting, unauthorized administrative actions (such as creating backdoor accounts or modifying store settings), and potential lateral movement within the Craft CMS admin panel. The CVSS v4.0 scoring reflects high subsequent-system confidentiality and integrity impact, indicating significant risk to the broader administrative environment despite no direct impact on the vulnerable system itself (Github Advisory).

The vulnerability requires high privileges (admin access) to plant the payload and passive user interaction (another admin visiting the dashboard) to trigger it, limiting its exploitability compared to unauthenticated XSS flaws. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.029% (9th percentile), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A proof-of-concept is included in the public GitHub Security Advisory (Craft Commerce Advisory, Github Advisory).

1. Gain Admin Access: Log in to the Craft Commerce admin panel with an account that has permissions to manage Order Statuses (admin-level access required).
2. Navigate to Order Statuses: Go to Commerce → Settings → Order Statuses within the admin panel.
3. Create a Malicious Order Status: Create a new Order Status and set the Name field to a JavaScript payload, such as <img src=x onerror=alert(document.cookie)> or a more sophisticated payload to exfiltrate session cookies to an attacker-controlled server.
4. Associate Orders with the Malicious Status: Place or modify orders so they are assigned the malicious Order Status, ensuring it appears in the "Recent Orders" widget data.
5. Trigger Execution: When any admin navigates to the Craft CMS dashboard (/admin/dashboard) and has the "Recent Orders" widget configured to display the affected status, the injected script executes in their browser context.
6. Harvest Results: The executed script can steal session cookies, perform actions on behalf of the victim admin, or establish persistence by creating additional admin accounts (Craft Commerce Advisory).

• Logs: Craft CMS admin access logs showing unusual Order Status creation or modification events, particularly with names containing HTML tags or JavaScript syntax (<script>, onerror=, javascript:, etc.).
• Logs: Admin dashboard access (/admin/dashboard) shortly followed by unexpected outbound HTTP requests from the admin's browser to external domains (visible in web proxy or browser network logs).
• File System: Review of the Craft Commerce database for Order Status Name fields containing HTML entities or script tags that deviate from normal naming conventions.
• Network: Outbound requests from admin browsers to unfamiliar external endpoints carrying encoded cookie or session data, potentially as query parameters or POST bodies.

Craft CMS has released patched versions that resolve this vulnerability: Craft Commerce 5.5.2 (for the 5.x branch) and Craft Commerce 4.10.1 (for the 4.x branch). The fix applies Craft.escapeHtml() to the value.name field before DOM insertion, preventing script execution. Administrators should upgrade to the patched versions immediately. As a temporary workaround prior to patching, administrators should audit existing Order Status Names for suspicious content and restrict admin account creation to trusted personnel only (Release 5.5.2, Release 4.10.1, Fix Commit).