VulnerabilityAnalyzed

CVE-2026-29177

Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details.

LOW 1.9EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.

CVSS 4.0: 1.9 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: craftcms/craft commerce
Source: security-advisories@github.com

References

https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68aPatch
https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvpExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.