Craft Commerce vulnerabilities

2 known vulnerabilities in Craft Commerce from Craft CMS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  commerce: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-29174Mar 10, 2026Craft CMS

  Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrde

• 8.8 High severity

  commerce: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-29172Mar 10, 2026Craft CMS

  Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array