CVE-2026-29173: Craft Commerce has Stored XSS while updating Order Status from Orders Table
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur.
--- Proof of Concept Required Permissions - Admin access (to edit/create Order Statuses)
Steps to Reproduce 1. Log in with an admin account 2. Navigate to Commerce → Settings → Order Statuses 3. Create a new order status 4. Set the Name field to: html <img src=x onerror="alert('Order Statuses XSS')"> 5. Save the order status 6. Go to Commerce → Orders (make sure you placed any orders) 7. From the left panel, select any Order Status (e.g., New) 8. Select any order from the orders table → Click on the Gear Icon → then click "Update Order Status..." 9. Notice the XSS execution
Other sources
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29173?
CVE-2026-29173 is classified as a stored XSS vulnerability due to improper escaping when updating the Order Status.
How do I fix CVE-2026-29173?
To mitigate CVE-2026-29173, upgrade Craft Commerce to version 5.5.3 or 4.10.2 or later.
Which versions of Craft Commerce are affected by CVE-2026-29173?
Craft Commerce versions from 4.0.0 to 4.10.1 and from 5.0.0 to 5.5.2 are affected by CVE-2026-29173.
Can CVE-2026-29173 lead to data compromise?
Yes, CVE-2026-29173 can allow an attacker to execute scripts in the context of the user's session, potentially leading to data compromise.
What are the implications of CVE-2026-29173 for Craft Commerce users?
Users of affected versions of Craft Commerce could be vulnerable to cross-site scripting attacks, affecting the integrity and security of user data.