Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-29177Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
Low 1.9
In plain English
A low-severity cross-site scripting in commerce from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/commerce | 4.10.2 | GHSA-mj32-r678-7mvp |
| Packagist | craftcms/commerce | 5.5.3 | GHSA-mj32-r678-7mvp |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P