craftcms commerce vulnerabilities

Newest CVEs

• CVE-2026-55795

  Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

  craftcms · commerce

  Medium6.9
• CVE-2026-32272

  Craft Commerce: Blind SQL Injection via hasVariant/hasProduct

  craftcms · commerce

  High8.7
• CVE-2026-32271

  Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

  craftcms · commerce

  High7.7
• CVE-2026-32270

  Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments

  craftcms · commerce

  Low1.7
• CVE-2026-31867

  Craft Commerce has a Potential IDOR in Commerce carts

  craftcms · commerce

  Medium6.3
• CVE-2026-29177

  Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

  craftcms · commerce

  Low1.9
• CVE-2026-29176

  Craft Commerce has Stored XSS in Inventory Location Name

  craftcms · commerce

  Medium4.8
• CVE-2026-29175

  Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking

  craftcms · commerce

  High8.6
• CVE-2026-29174

  Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting

  craftcms · commerce

  High8.7
• CVE-2026-29173

  Craft Commerce has Stored XSS while updating Order Status from Orders Table

  craftcms · commerce

  Low1.9