CVE-2026-25490: 
PHP vulnerability analysis and mitigation

CVE-2026-25490 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce, an ecommerce platform for Craft CMS, that allows attackers to execute malicious JavaScript in an administrator's browser. The vulnerability affects versions 4.0.0-RC1 through 4.10.0 and 5.0.0 through 5.5.1, and was disclosed on February 2, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.1 (Medium) (Github Advisory, Craft Commerce Advisory).

The root cause is improper output encoding (CWE-79) — the Address Line 1 field in Inventory Locations is stored and later rendered in the admin panel without HTML encoding, allowing injected scripts to execute in the browser context. The fix, applied in commit fa27333, wraps the field value with Html::encode() in InventoryLocationsController.php before it is passed to the table data response; the same encoding fix was also applied to several other controllers (ShippingCategories, ShippingMethods, ShippingZones, TaxCategories, TaxRates, TaxZones) that had similar issues (Craft Commerce Commit). Exploitation requires the attacker to hold an authenticated account with control panel access, Craft Commerce access, and the "Manage inventory locations" permission, plus an active elevated session (Craft Commerce Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any administrator who views the Inventory Locations page in the admin panel. Potential consequences include session hijacking, credential theft via fake login overlays, and privilege escalation — the advisory demonstrates a payload that can elevate the attacker's account to full administrator status if a victim admin has an active elevated session. The attack is scoped to the admin panel and does not directly affect availability, but the integrity impact on the subsequent system (the broader Craft CMS installation) is rated High (Github Advisory, Craft Commerce Advisory).

Proof-of-concept exploit details are publicly documented in the GitHub Security Advisory, including specific steps to reproduce and a privilege escalation payload. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.025% (0.000430 per Feedly), placing it in the 7th percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Craft Commerce Advisory).

1. Obtain required access: Acquire or compromise a Craft CMS account with the following permissions: Access the control panel, Access Craft Commerce, and Manage inventory locations, along with an active elevated session.
2. Navigate to the vulnerable endpoint: Log in to the admin panel and go to Commerce → Inventory Locations → Default (typically at /admin/commerce/inventory-locations/1).
3. Inject XSS payload: In the Address Line 1 field, enter a malicious JavaScript payload (e.g., <script>alert(1)</script> for proof-of-concept, or a more sophisticated payload for privilege escalation or credential harvesting).
4. Save the record: Click Save; the payload is stored in the database without sanitization.
5. Trigger execution: When any administrator navigates to the Inventory Locations listing page, the stored payload is rendered unsanitized in the table, executing the JavaScript in their browser context.
6. Privilege escalation (advanced): Replace the basic payload with one that calls the Craft CMS API to elevate the attacker's user account to administrator, targeting the victim's active elevated session. Alternatively, inject a fake "Session Expired" login modal to harvest admin credentials directly (Craft Commerce Advisory).

• Logs: Admin panel access logs showing requests to /admin/commerce/inventory-locations from unexpected IP addresses or at unusual times; audit log entries showing modification of Inventory Location Address Line 1 fields to values containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:).
• Database: Inventory Location records in the database where the address1 (or equivalent) column contains HTML or JavaScript content rather than a plain address string.
• Network: Outbound requests from administrator browsers to unexpected external domains (e.g., attacker-controlled servers) originating from admin panel pages, potentially carrying session tokens or credentials.
• User Account Changes: Unexpected elevation of non-administrator accounts to administrator status in the Craft CMS user management panel, particularly accounts with commerce permissions (Craft Commerce Advisory).

Upgrade Craft Commerce to version 4.10.1 (for the 4.x branch) or 5.5.2 (for the 5.x branch), which apply Html::encode() to all affected fields (Release 4.10.1, Release 5.5.2). As interim measures, restrict the "Manage inventory locations" permission to only fully trusted administrator accounts, audit existing Inventory Location Address Line 1 entries for suspicious content, and consider deploying a Content Security Policy (CSP) header to limit inline script execution in the admin panel. Monitor administrator account activity for unexpected privilege changes following disclosure.