phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is craftcms/commerce vulnerable?

Composer craftcms/commerce has 21 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.

21advisories
0critical
0on CISA KEV
0no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypassmedium0.0>=5.0.0 and <5.6.5 or >=4.0.0 and <4.11.25.6.5, 4.11.2
CVE-2026-32271Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widgethigh0.0>=4.0.0 and <4.10.3 or >=5.0.0 and <5.5.54.10.3, 5.5.5
CVE-2026-29174Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sortinghigh0.0>=5.0.0 and <5.5.35.5.3
CVE-2026-29172Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sortinghigh0.0>=4.0.0 and <4.10.2 or >=5.0.0 and <5.5.34.10.2, 5.5.3
CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)medium0.0>=5.0.0 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltrationmedium0.0>=5.0.0 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-29173Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Tablelow0.0>=4.0.0 and <4.10.2 or >=5.0.0 and <5.5.34.10.2, 5.5.3
CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-32272Craft Commerce hasVariant/hasProduct Blind SQL Injectionhigh0.0>=5.0.0 and <5.6.05.6.0
CVE-2026-25484Craft Commerce has Stored XSS in Product Type Namemedium0.0>=5.0.0 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.2 or >=4.0.0-RC1 and <4.10.15.5.2, 4.10.1
CVE-2026-31867Craft Commerce: Potential IDOR in Commerce cartsmedium0.0>=5.0.0 and <5.6.0 or >=4.0.0 and <4.11.05.6.0, 4.11.0
CVE-2026-32270Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous paymentslow0.0>=5.0.0 and <5.6.0 or >=4.0.0 and <4.11.05.6.0, 4.11.0
CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalationmedium0.0>=5.0.0-RC1 and <5.5.25.5.2
CVE-2026-29176Craft Commerce has stored XSS in Inventory Location Namemedium0.0>=5.0.0 and <5.5.35.5.3
CVE-2026-29177Craft Commerce has stored XSS in Craft Commerce Order Details Slideoutlow0.0>=4.0.0 and <4.10.2 or >=5.0.0 and <5.5.34.10.2, 5.5.3
CVE-2026-29175Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijackinghigh0.0>=5.0.0 and <5.5.35.5.3
GHSA-78vr-q6cf-c7p6Craft Commerce: Partial Payment Amount Without Lower Bound Validationmedium0.0>=5.0.0 and <5.6.5 or >=4.0.0 and <4.11.25.6.5, 4.11.2

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.