VulnerabilityAnalyzed

CVE-2026-29175

Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page.

HIGH 8.6EPSS 0.20%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: craftcms/craft commerce
Source: security-advisories@github.com

References

https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33aPatch
https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624Exploit, Vendor Advisory
https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.