Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
21 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. Details When an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes. Vulnerable Code <img width="864" height="90" alt="resim" src="https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba" / <img width="881" height="272" alt="resim" src="https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd" / <img width="861" height="271" alt="resim" src="https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703" / PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. <img width="909" height="171" alt="resim" src="https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e" / Impact An attacker…
Recommended action: Upgrade to 5.6.5 or 4.11.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check. Details When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction. <img width="690" height="80" alt="image" src="https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73" / <img width="761" height="200" alt="image" src="https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77" / PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. <img width="606" height="144" alt="image" src="https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80" / Impact On stores with partial payment enabled, a customer may be able…
Recommended action: Upgrade to 5.6.5 or 4.11.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. Details I manually audited frontend payment flows and found that actionPay() retrieves orders by number before authorization is fully enforced. Code path: 1. Load order by number. 2. Evaluate whether payment is authorized for completed orders (number + matching email). 3. If unauthorized, return failure. 4. Failure response still includes cartArray($order), which serializes sensitive order data. Why is this a vulnerability? - Authorization logic says the requester is not allowed to pay for a completed order without an email. - But the response still returns the same completed order’s contents. Impact Type: Information Disclosure / Broken…
Recommended action: Upgrade to 5.6.0 or 4.11.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities: SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks. PDO Multi-Statement Queries -- PHP PDO MySQL enables CLIENTMULTISTATEMENTS by default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table. Unrestricted unserialize() -- The yii2-queue PhpSerializer calls unserialize() with no allowedclasses restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object. Gadget Chain (FileCookieJar) -- GuzzleHttp\Cookie\FileCookieJar (a standard Guzzle dependency) has an unguarded destruct() method that calls fileputcontents(). The…
Recommended action: Upgrade to 5.5.5 or 4.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset() blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj. The blocklist only strips top-level Yii2 Query properties (where, orderBy, etc.), but hasVariant and hasProduct pass through untouched. Internally, these properties call Craft::configure() on a subquery without sanitization, re-introducing SQL injection via criteria[hasVariant][where]=INJECTEDSQL. An authenticated control panel user can perform boolean-based blind SQL injection through the patched ElementIndexesController and extract arbitrary database contents. Impact Full database read access via blind SQL injection Privilege escalation via security key extraction → forged admin sessions Prerequisites Authenticated control panel user Commerce plugin installed Products with variants in the database
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. Vulnerability Details Root Cause The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. --- Attack Scenario Prerequisites - Target Craft Commerce installation with active shopping carts - Knowledge of a victim’s cart number (32-character hex string) Cart Number Acquisition Vectors 1. Referrer Header Leakage: Cart URLs shared externally expose the number 2. Browser History: Accessible on shared/compromised devices 3. Proxy/WAF Logs: Cart numbers logged in URL parameters 4. Social Engineering: Support…
Recommended action: Upgrade to 5.6.0 or 4.11.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. Reproduction Steps 1. Navigate to Commerce - Store Management - Shipping Methods. 1. Click "New Shipping Method". 1. In the Name field, enter the following XSS payload: 1. Save the Shipping Method. 1. Place a new order or edit an existing order. 1. Set the order's Shipping Method to the one created in the previous steps. 1. Navigate to the Orders index page (/admin/commerce/orders). 1. Double-click the target order to open the details slideout. 1. Result: The XSS payload executes.
Recommended action: Upgrade to 5.5.3 or 4.10.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. Proof of Concept Permissions Required - General - Access the control panel - Access Craft Commerce - Craft Commerce - Manage inventory locations Steps to Reproduce 1. Log in to the control panel 2. Navigate to Commerce → Inventory Locations 3. Create or edit a location 4. Set Name to the following payload: 5. Save the location 6. Navigate to Commerce → Products and click "New Product" and click "New product variant" 7. The Inventory Location table loads, rendering the Inventory Location Name 8. XSS executes Impact - Potential Session Hijacking - Potential Database Exfiltration - Potential Account Takeover by forcing a password change on the victim’s account. -…
Recommended action: Upgrade to 5.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability enables session hijacking by fetching the PHP Info utility page, which displays unmasked session cookies. Unlike other XSS chains that require elevated sessions, this attack provides instant access to the victim’s session - no additional user interaction or elevated session approval required. Proof of Concept Permissions Required - Access the control panel - Access Craft Commerce - Create/Edit products Steps to Reproduce 1. Log in to the control panel 2. Navigate to Commerce → Products 3. Add a new product and set the Title field to: (replace https://attacker.com) 4. Save the product 5. Navigate to Commerce → Inventory (/admin/commerce/inventory) 6. XSS executes,…
Recommended action: Upgrade to 5.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. --- PoC Required Permissions - General - Access the control panel - Access Craft Commerce - Craft Commerce - Manage inventory stock levels Steps to reproduce 1. Log in to the control panel 2. Navigate to Commerce Inventory 3. Click on any sortable column header (e.g., "SKU") to trigger a sort request 4. Intercept the request and modify sort[0][direction] or sort[0][sortField] parameters and append ,sleep(2) payload to it's current value as follows: 6. Observe the delay in the response, confirming the injection Alternatively, you can use the following curl (bash syntax) command…
Recommended action: Upgrade to 5.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access (to edit/create Order Statuses) Steps to Reproduce 1. Log in with an admin account 2. Navigate to Commerce → Settings → Order Statuses 3. Create a new order status 4. Set the Name field to: 5. Save the order status 6. Go to Commerce → Orders (make sure you placed any orders) 7. From the left panel, select any Order Status (e.g., New) 8. Select any order from the orders table → Click on the Gear Icon → then click "Update Order Status..." 9. Notice the XSS execution
Recommended action: Upgrade to 5.5.3 or 4.10.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. --- PoC Required Permissions - General - Access the control panel - Access Craft Commerce - Craft Commerce - Manage orders - Edit orders Steps to reproduce 1. Log in to the control panel 2. Navigate to Commerce Orders Create a new order 3. Click on "Add a line item" to show the purchasables table 4. Intercept the AJAX request and modify the sort parameter as follows: 5. Observe the delay in the response, confirming the injection Alternatively, you can use the following curl (bash syntax) command (replace cookie and target domain as needed): Impact With this Blind SQLi, an attacker can: - Exfiltrate data…
Recommended action: Upgrade to 5.5.3 or 4.10.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. --- Proof of Concept Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage shipping - An active administrator elevated session Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Store Management - Shipping Zones (/admin/commerce/store-management/primary/shippingzones). 3. Create a new shipping zone. 4. In the Name field, enter the following payload: 4. Click Save & Go back to the previous page. 5. Notice the alert proving JavaScript execution. Privilege Escalation to Administrator: 1. Do the same steps above,…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. Proof of Concept Required Permissions - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage inventory locations - An active administrator elevated session <img width="887" height="832" alt="req-perms" src="https://github.com/user-attachments/assets/7a9a5ef6-4fc3-4af1-8ded-08861ead0b7e" / Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Inventory Locations - Default (/admin/commerce/inventory-locations/1). 3. In the Address Line 1 field, enter the following payload: 4. Click Save and you'll be redirected back to the Inventory Locations page. 5. Notice the alert proving…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. Proof of Concept Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage taxes - An active administrator elevated session Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Store Management - Tax Zones (/admin/commerce/store-management/primary/taxzones). 3. Create a new tax zone. 4. In the Name or Description field, enter the following payload: 4. Click Save and you’ll be redirected back to the previous page. 5. Notice the alert proving JavaScript execution. <img width="1904" height="418" alt="poc"…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Tax Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. --- Proof of Concept Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage taxes - An active administrator elevated session Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Store Management - Tax Categories (/admin/commerce/store-management/primary/taxcategories). 3. Create a new tax category. 4. In the Name or Description field, enter the following payload: 4. Click Save and you'll be redirected back to the previous page. 5. Notice the alert proving JavaScript execution. Privilege Escalation to…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. Proof of Concept Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage taxes - An active administrator elevated session Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Store Management - Tax Rates (/admin/commerce/store-management/primary/taxrates). 3. Create a new tax rate. 4. In the Name field, enter the following payload: 4. Pick or create a Tax Category since it’s required to save the tax rate. 5. Click Save and you’ll be redirected back to the previous page. 6. Notice the alert proving JavaScript execution. <img…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. --- Proof of Concept Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage shipping - An active administrator elevated session Steps to Reproduce 1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to Commerce - Store Management - Shipping Methods (/admin/commerce/store-management/primary/shippingmethods). 3. Create a new shipping method. 4. In the Name field, enter the following payload: 4. Click Save & Go back to the previous page. 5. Notice the alert proving JavaScript execution. Privilege Escalation to Administrator: 1. Do the same steps above, but…
Recommended action: Upgrade to 5.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. Reporting to Commerce GHSA since the input originates here. Users are recommended to update to the patched 5.5.2 release to mitigate the issue. --- Proof of Concept Required Permissions (Attacker) - Admin access (to edit Commerce settings) Steps to Reproduce 1. Log in as attacker with admin permissions. 2. Go to Commerce - Settings - Product Types (/admin/commerce/settings/producttypes). 3. Create a new Product Type. 4. Set Name to: 5. Save the Product Type. 6. Go to Users - Edit any user - Click on Permissions tab (/admin/users/{UserID}/permissions). 7. Alert fires instantly (when the Product Type checkbox renders). Resources https://github.com/craftcms/commerce/commit/7e1dedf06038c8e70dce0187b7048d4ab8ffb75c
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. Users are recommended to update to the patched 5.5.2 release to mitigate the issue. --- Proof of Concept Required Permissions - General - Access the control panel - Access Craft Commerce - Access to the database backup utility - Craft Commerce - Manage orders - Edit orders Attacker Server Setup To reproduce this attack, you need a server to receive the exfiltrated database. 1. Save the Python script as receiver.py on your attacker machine. 2. Run it: python3 receiver.py -- Change the port if needed. <details <summaryServer Python Script</summary </details Steps to…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2 release to mitigate the issue. --- Proof of Concept Required Permissions - Admin access (to edit/create Order Statuses) Steps to Reproduce 1. Log in with an admin account 2. Navigate to Commerce → Settings → Order Statuses 3. Create new order status (e.g., "Pending") 4. Set the Name field to: 5. Save the order status 6. Go to Commerce Orders & make some orders with different statuses (e.g. "New" & "the malicious created status") 7. Go to the Dashboard (/admin/dashboard) & Add "Recent Orders" widget and pick the same 2 statuses for orders 8. Notice the XSS execution <img width="1491" height="568" alt="xss-execution-in-dashboard"…
Recommended action: Upgrade to 5.5.2 or 4.10.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.