- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, commerce recorded 1 security vulnerability in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of commerce and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit BypassCVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProductCVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetCVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsCVE-2026-31867Craft Commerce has a Potential IDOR in Commerce carts| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProduct | Exploitation statusNot exploited | FixYes | Published04/13/2026 | SeverityHigh |
|---|
CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget | Exploitation statusNot exploited | FixYes | Published04/13/2026 | SeverityHigh |
|---|
CVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments | Exploitation statusNot exploited | FixYes | Published04/13/2026 | SeverityLow |
|---|
CVE-2026-31867Craft Commerce has a Potential IDOR in Commerce carts | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-29177Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityLow |
|---|
CVE-2026-29176Craft Commerce has Stored XSS in Inventory Location Name | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityMedium |
|---|
CVE-2026-29175Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking | Exploitation statusActively exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-29174Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-29173Craft Commerce has Stored XSS while updating Order Status from Orders Table | Exploitation statusNot exploited | FixYes | Published03/10/2026 | SeverityLow |
|---|
CVE-2026-29172Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting | Exploitation statusActively exploited | FixYes | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25485Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25484Craft Commerce has Stored XSS in Product Type Name | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
21 Results | Page 1 of 1