Craftcms Craft Commerce — known CVE vulnerabilities

Every CVE whose affected-product data names Craftcms Craft Commerce, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (17)

• CVE-2026-29174 — CVSS 8.8 (high): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory…
• CVE-2026-29172 — CVSS 8.8 (high): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the…
• CVE-2026-29175 — CVSS 5.4 (medium): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The…
• CVE-2026-29177 — CVSS 5.4 (medium): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists…
• CVE-2026-25483 — CVSS 5.4 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-25488 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-25489 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-25490 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-25522 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-29173 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to…
• CVE-2026-29176 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings -…
• CVE-2026-25482 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS…
• CVE-2026-31867 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability…
• CVE-2026-25484 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS…
• CVE-2026-25485 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…
• CVE-2026-25486 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows…
• CVE-2026-25487 — CVSS 4.8 (medium): Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS…