CVE-2026-29177: Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-79

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.

Affected products

craftcms commerce: from 4.0.0 before 4.10.2; from 5.0.0 before 5.5.3 — fixed in 4.10.2, 5.5.3

How to fix

Upgrade to a fixed version: craftcms commerce 4.10.2, 5.5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-29177 or the next vulnerability affects your stack