Read the docs
TI-2026-23294 Aliases CVE-2026-29177GHSA-mj32-r678-7mvp

Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

Priority LOW 10CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed craftcms/commerce (Packagist): 4.10.2, 5.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScommerce>= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3—No fix listedCNA
—craftcms/commerce (Packagist)4.0.0 to before 4.10.24.10.2Patch availableGHSA-mj32-r678-7mvp
—craftcms/commerce (Packagist)5.0.0 to before 5.5.35.5.3Patch availableGHSA-mj32-r678-7mvp
  • commerce VendorCraft CMS Affected >= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3 Fixed in — No fix listed CNA
  • craftcms/commerce (Packagist) Vendor— Affected 4.0.0 to before 4.10.2 Fixed in 4.10.2 Patch available GHSA-mj32-r678-7mvp
  • craftcms/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.5.3 Fixed in 5.5.3 Patch available GHSA-mj32-r678-7mvp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*4.0.0 to before 4.10.2; 5.0.0 to before 5.5.3VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:* Versions 4.0.0 to before 4.10.2; 5.0.0 to before 5.5.3 Vulnerable ·Craft CMS

Remediation

  • Fix · GHSA-mj32-r678-7mvp craftcms/commerce (Packagist) Fixed in 4.10.2 Advisory →
  • Fix · GHSA-mj32-r678-7mvp craftcms/commerce (Packagist) Fixed in 5.5.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29177
  2. 2026-10-03 Alias added: GHSA-mj32-r678-7mvp

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-23289 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting CVSS 4.0HIGH 8.7
  • TI-2026-23292 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVSS 4.0HIGH 8.6
  • TI-2026-20631 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20601 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20600 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
  • TI-2026-20599 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVSS 4.0MEDIUM 6.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences