CVE-2025-66572: Loadedcommerce Loaded Commerce

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.

Affected products

• Loadedcommerce Loaded Commerce: version 6.6 only

Published 2025-12-04. Last modified 2026-06-17.