CVE-2024-35240: Stored Cross-site Scripting on Print Functionality in Umbraco Commerce

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-28 · updated 2026-06-17
Weakness: CWE-79

Description

Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Umbraco.Commerce.Issues: from 12.0.0, < 12.1.4; before 10.0.5

References

https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023
https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w
https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023
https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w

Get alerted when CVE-2024-35240 or the next vulnerability affects your stack