How many CVEs have a located fix in craftcms/commerce?

13 published CVEs have a fix traced to functions in craftcms/commerce, touching 27 functions across 25 files.

Which function in craftcms/commerce has been patched by the most CVEs?

behaviors in src/controllers/CartController.php has been changed by 2 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in craftcms/commerce?

The median fix changes 10 lines. 69% of fixes change 20 lines or fewer, and 54% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#457 of 500 repositories

craftcms/commerce

Name: craftcms/commerce: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 14, 2026

13

CVE fixes located

Published CVEs

27

Functions patched

Distinct function sites

25

Files patched

Distinct source files

2026

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in craftcms/commerce, the earliest published in 2026. Those fixes changed 27 distinct functions across 25 files, in 56 patch hunks.

Among the 500 repositories tracked here, craftcms/commerce ranks #457 by the number of CVEs with a located fix.

Most patched functions

Functions in craftcms/commerce changed by the most CVE fixes.

Most patched files

Files in craftcms/commerce changed by the most CVE fixes.

1src/controllers/CartController.php3 CVEs · 4 functions
2src/controllers/OrdersController.php2 CVEs · 4 functions
3src/elements/Order.php2 CVEs · 3 functions
4src/controllers/DownloadsController.php1 CVEs · 1 functions
5src/controllers/InventoryController.php1 CVEs · 1 functions
6src/controllers/PaymentsController.php1 CVEs · 1 functions
7src/elements/actions/CopyLoadCartUrl.php1 CVEs · 1 functions
8src/elements/actions/UpdateOrderStatus.php1 CVEs · 1 functions
9src/elements/db/ProductQuery.php1 CVEs · 1 functions
10src/elements/db/VariantQuery.php1 CVEs · 1 functions

Fix size

How much code a CVE fix in craftcms/commerce changes, with backports counted once.

10

Median lines changed

Added plus removed, per CVE

69%

Fixes of 20 lines or fewer

Share of CVE fixes

54%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in craftcms/commerce, and the functions each fix changed.

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
CVE-2026-55795behaviors CartController
Medium · CVSS 6.9
EPSS 0.5%2026-09-14
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
CVE-2026-32272cleanseQueryCriteria _applyHasProductParam _applyHasVariantParam
High · CVSS 8.7
EPSS 0.5%2026-04-13
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
CVE-2026-32271defineRules getData
High · CVSS 8.7
EPSS 0.6%2026-04-13
Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
CVE-2026-32270actionPay
Low · CVSS 1.7
EPSS 0.5%2026-04-13
Craft Commerce has a Potential IDOR in Commerce carts
CVE-2026-31867renderCartEmailChallenge actionLoadCart IpRateLimitIdentity
Medium · CVSS 6.3
EPSS 0.3%2026-03-11
Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
CVE-2026-29177getMetadata
Low · CVSS 1.9
EPSS 0.3%2026-03-10
Craft Commerce has Stored XSS in Inventory Location Name
CVE-2026-29176inputHtml
Medium · CVSS 4.8
EPSS 0.3%2026-03-10
Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
CVE-2026-29175actionInventoryLevelsTableData
High · CVSS 8.6
EPSS 0.3%2026-03-10
Craft Commerce has Stored XSS while updating Order Status from Orders Table
CVE-2026-29173getTriggerHtml
Low · CVSS 1.9
EPSS 0.4%2026-03-10
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
CVE-2026-29172in_array actionPurchasablesTable actionUserOrdersTable
High · CVSS 8.7
EPSS 0.5%2026-03-10
Craft Commerce has Stored XSS in Product Type Name
CVE-2026-25484
Medium · CVSS 4.8
EPSS 0.4%2026-02-03
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
CVE-2026-25483
Medium · CVSS 6.2
EPSS 0.4%2026-02-03

Get an alert for each new craftcms/commerce CVE, with the patched functions and AI-written analysis.

Monitor commerce CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs debian/bind913 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in craftcms/commerce.

How many CVEs have a located fix in craftcms/commerce?: 13 published CVEs have a fix traced to functions in craftcms/commerce, touching 27 functions across 25 files.
Which function in craftcms/commerce has been patched by the most CVEs?: behaviors in src/controllers/CartController.php has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in craftcms/commerce?: The median fix changes 10 lines. 69% of fixes change 20 lines or fewer, and 54% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track craftcms/commerce CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing