CVE-2026-25486: 
PHP vulnerability analysis and mitigation

CVE-2026-25486 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS, that allows attackers to execute malicious JavaScript in an administrator's browser. The vulnerability affects Craft Commerce versions 5.0.0-RC1 through 5.5.1 and was disclosed on February 2, 2026, with a patch released in version 5.5.2. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.1 (Medium) (Github Advisory, Craft Commerce Advisory).

The root cause is improper output encoding (CWE-79) — user-supplied input in the Shipping Methods Name field within the Store Management section is stored in the database and later rendered in the admin panel without HTML encoding, allowing injected script tags to execute in the browser context. The fix, applied in commit fa27333, wraps affected fields across multiple controllers (ShippingMethodsController, ShippingCategoriesController, ShippingZonesController, TaxCategoriesController, TaxRatesController, TaxZonesController, and InventoryLocationsController) with Html::encode() calls to properly escape output (Craft Commerce Commit). Exploitation requires the attacker to hold specific Craft Commerce permissions: access to the control panel, "Manage store settings," and "Manage shipping" (Craft Commerce Advisory).

Successful exploitation allows an attacker with limited store management permissions to execute arbitrary JavaScript in the browser of any administrator who views the Shipping Methods page, enabling session hijacking, credential theft via fake login overlays, or privilege escalation to full administrator access. The advisory's proof-of-concept demonstrates that a malicious payload can silently elevate the attacker's own account to administrator-level privileges when an admin with an active elevated session visits the vulnerable page. The scope is limited to the admin panel, with low confidentiality impact and high integrity impact on subsequent systems (Github Advisory, Craft Commerce Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, detailing exact steps and payload types for both basic XSS execution and privilege escalation (Craft Commerce Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.024% (7th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain required permissions: Acquire a Craft Commerce account with control panel access and the "Manage store settings" and "Manage shipping" permissions — these may be granted to non-administrator store managers.
2. Navigate to the vulnerable endpoint: Log in to the admin panel and go to Commerce → Store Management → Shipping Methods (/admin/commerce/store-management/primary/shippingmethods).
3. Inject XSS payload: Create a new shipping method and enter a JavaScript payload (e.g., <script>alert(1)</script> for proof-of-concept, or a malicious payload for privilege escalation) in the Name field, then save.
4. Trigger execution: When an administrator with an active elevated session navigates to the Shipping Methods listing page, the stored payload executes in their browser context.
5. Escalate privileges (optional): Use the XSS payload to make an authenticated API request that promotes the attacker's user ID to administrator, or deploy a fake "Session Expired" login modal on the trusted domain to harvest admin credentials. If the admin's session is stale, the attacker can force a logout so the payload fires on re-authentication within a fresh elevated session (Craft Commerce Advisory).

• Logs: Admin panel access logs showing requests to /admin/commerce/store-management/primary/shippingmethods from unusual accounts or at unusual times; audit log entries showing shipping method creation or modification by non-administrator accounts.
• Application Data: Shipping method names in the database containing HTML tags, <script> blocks, JavaScript event handlers (e.g., onerror, onload), or encoded variants thereof.
• Network: Outbound HTTP requests from the admin panel browser session to unexpected external domains (potential data exfiltration or C2 beaconing triggered by XSS payload).
• User Account Changes: Unexpected elevation of a non-administrator user account to administrator role in the Craft CMS user management panel, particularly if not performed by a known admin (Craft Commerce Advisory).

Upgrade Craft Commerce to version 5.5.2 or later, which applies Html::encode() to all affected name and description fields across shipping, tax, and inventory controllers (Craft Commerce Release, Craft Commerce Commit). No configuration-based workaround is available; patching is the only remediation. As an interim measure, restrict the "Manage store settings" and "Manage shipping" permissions to fully trusted users only to reduce the attack surface.