Advisories for package craftcms/commerce

Listing reported advisories for package craftcms/commerce sorted by their report date.

Craft Commerce: Potential IDOR in Commerce carts
GitHub

craftcms/commerce

>= 4.0.0, < 4.11.0 · >= 5.0.0, < 5.6.0

2026-03-10 18:24:50
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:24:20
Craft Commerce has stored XSS in Inventory Location Name
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:24:00
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:43
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:27
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:18
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:08
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:04:01
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:02:34
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:00:13
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:52
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:17
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:49:55
Craft Commerce has Stored XSS in Product Type Name
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:44:05
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:43:01
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:41:44