[MEDIUM] Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation

PKSA-gnb2-rr3g-hcdr CVE-2026-25488 GHSA-p6w8-q63m-72c8

Affected package: craftcms/commerce

Affected version: >=4.0.0-RC1,<=4.10.0|>=5.0.0-RC1,<=5.5.1

Reported by:
GitHub