Vulnerability Description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Craftcms | Craft Commerce | >= 4.0.0, < 4.10.2 |
Related Weaknesses (CWE)
References
- https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5ddPatch
- https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvpExploitVendor Advisory
FAQ
What is CVE-2026-29177?
CVE-2026-29177 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can...
How severe is CVE-2026-29177?
CVE-2026-29177 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29177?
Check the references section above for vendor advisories and patch information. Affected products include: Craftcms Craft Commerce.