CVE-2026-25484: 
PHP vulnerability analysis and mitigation

CVE-2026-25484 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS. The flaw allows an authenticated admin to inject unsanitized JavaScript via a maliciously crafted Product Type name, which executes in the browser of any user who views the CMS user permissions settings page. Affected versions include Craft Commerce 4.0.0-RC1 through 4.10.0 and 5.0.0 through 5.5.1. It was disclosed on February 2, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a missing HTML encoding step in the Twig template src/templates/settings/producttypes/index.twig. The Product Type name was rendered using type.name|t('site') without the |e (escape) filter, allowing raw HTML/JavaScript to be stored and later reflected in the CMS user permissions page when the Product Type checkbox is rendered. The source of the injection is the Commerce Product Type settings (/admin/commerce/settings/producttypes), while the sink is the CMS user permissions tab (/admin/users/{UserID}/permissions). The fix, applied in commit 7e1dedf, adds the |e escape filter: type.name|t('site')|e (Patch Commit, GitHub Advisory).

Successful exploitation allows an attacker-controlled script to execute in the browser context of any administrator or privileged user who navigates to the user permissions settings page. This can lead to session token theft, unauthorized actions performed on behalf of the victim, or further privilege escalation within the Craft CMS admin panel. Confidentiality and integrity of the subsequent (victim's) system are both impacted at a low level, while availability is unaffected (Github Advisory).

Exploitation requires the attacker to already possess admin-level access to the Craft Commerce backend, significantly limiting the attack surface. User interaction is required — a separate privileged user must visit the affected permissions page for the payload to execute. The EPSS score is approximately 0.019% (6th percentile), indicating a low probability of exploitation in the wild. No evidence of in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Gain Admin Access: Log in to the Craft CMS backend with an account that has admin privileges and access to Commerce settings.
2. Navigate to Product Types: Go to Commerce → Settings → Product Types (/admin/commerce/settings/producttypes).
3. Create a Malicious Product Type: Create a new Product Type and set the Name field to an XSS payload such as <script>alert(document.cookie)</script> or a more sophisticated payload to exfiltrate session tokens.
4. Save the Product Type: Save the entry; the payload is now stored in the database without sanitization.
5. Trigger Execution: When any user (including other admins) navigates to Users → Edit any user → Permissions tab (/admin/users/{UserID}/permissions), the Product Type checkbox renders the unsanitized name, causing the injected script to execute immediately in the victim's browser (GitHub Advisory).

• Logs: CMS access logs showing requests to /admin/commerce/settings/producttypes with unusual or encoded characters in POST body parameters (e.g., <script>, %3Cscript%3E) for the Product Type name field.
• Logs: Access log entries showing visits to /admin/users/{UserID}/permissions shortly after a new Product Type was created, potentially indicating the payload was triggered.
• Database: Product Type records in the Craft Commerce database containing HTML tags or JavaScript in the name column of the relevant product types table.
• Network: Outbound requests from admin browsers to unexpected external domains (e.g., attacker-controlled servers) originating from the /admin/users/ permissions page, which may indicate session token exfiltration.

Craft Commerce has released patched versions 4.10.1 and 5.5.2 that resolve this vulnerability by adding proper HTML encoding to the Product Type name in the Twig template. Users should upgrade to one of these versions immediately. No configuration-based workaround is available; upgrading is the only remediation (Release 4.10.1, Release 5.5.2, GitHub Advisory).