Vulnerability Description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Craftcms | Craft Commerce | >= 4.0.0, < 4.10.2 |
Related Weaknesses (CWE)
References
- https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b6633Patch
- https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5dPatch
- https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cpExploitVendor Advisory
FAQ
What is CVE-2026-29173?
CVE-2026-29173 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Ord...
How severe is CVE-2026-29173?
CVE-2026-29173 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29173?
Check the references section above for vendor advisories and patch information. Affected products include: Craftcms Craft Commerce.