craftcms/commerce vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-55795Mediumcraftcms/commerce: Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass GHSA-78VR-Q6CF-C7P6Mediumcraftcms/commerce: Craft Commerce: Partial Payment Amount Without Lower Bound Validation CVE-2026-32270Lowcraftcms/commerce: Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments CVE-2026-32271Highcraftcms/commerce: Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget CVE-2026-32272Highcraftcms/commerce: Craft Commerce hasVariant/hasProduct Blind SQL Injection CVE-2026-31867Mediumcraftcms/commerce: Craft Commerce: Potential IDOR in Commerce carts CVE-2026-29177Lowcraftcms/commerce: Craft Commerce has stored XSS in Craft Commerce Order Details Slideout CVE-2026-29176Mediumcraftcms/commerce: Craft Commerce has stored XSS in Inventory Location Name CVE-2026-29175Highcraftcms/commerce: Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking CVE-2026-29174Highcraftcms/commerce: Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting CVE-2026-29173Lowcraftcms/commerce: Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table CVE-2026-29172Highcraftcms/commerce: Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting CVE-2026-25522Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25490Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVE-2026-25489Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVE-2026-25488Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25487Mediumcraftcms/commerce: Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVE-2026-25486Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation CVE-2026-25484Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Product Type Name CVE-2026-25483Mediumcraftcms/commerce: Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration CVE-2026-25482Mediumcraftcms/commerce: Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo