Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.
Reproduction Steps
- Navigate to Commerce -> Store Management -> Shipping Methods.
- Click "New Shipping Method".
- In the Name field, enter the following XSS payload:
html
<img src=x onerror=alert('XSS_Shipping')> - Save the Shipping Method.
- Place a new order or edit an existing order.
- Set the order's Shipping Method to the one created in the previous steps.
- Navigate to the Orders index page (
/admin/commerce/orders). - Double-click the target order to open the details slideout.
- Result: The XSS payload executes.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | craftcms/commerce | >= 4.0.0, < 4.10.2, >= 5.0.0, < 5.5.3 | 4.10.2, 5.5.3 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
craftcms/commerce- Disclosed
- 10.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mj32-r678-7mvp - CC BY 4.0
Vulnerability history: craftcms/commerce
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 21
- First → latest
- 02.2026 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 13
- Low 3
Disclosures per year
- 2026: 21
-
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.