CVE-2026-29177: low-severity vulnerability in craftcms commerce
Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 1.9epss 0.2%
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
craftcms · commerceRelated CVEs — craftcms commerce
In the same product, most dangerous first.
CVE-2026-55795MEDIUMCraft Commerce: Coupon Code Brute-Force via Rate Limit BypassEPSS 0.5%CVE-2026-29174HIGHCraft Commerce has a SQL Injection in Commerce Inventory Table SortingEPSS 0.5%CVE-2026-32271HIGHCraft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetEPSS 0.5%CVE-2026-29172HIGHCraft Commerce has a SQL Injection in Commerce Purchasables Table SortingEPSS 0.5%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2026-25482MEDIUMCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)EPSS 0.3%