Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/craftcms/composer@5.0.0-RC1
purl pkg:composer/craftcms/composer@5.0.0-RC1
Next non-vulnerable version 5.5.2
Latest non-vulnerable version 5.5.2
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ygca-wsvj-abff
Aliases:
CVE-2026-25485
GHSA-w8gw-qm8p-j9j3
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel. ---
5.5.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:49:50.502384+00:00 GitLab Importer Affected by VCID-ygca-wsvj-abff https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/craftcms/composer/CVE-2026-25485.yml 38.6.0