CVE-2026-29177: Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.
Reproduction Steps 1. Navigate to Commerce -> Store Management -> Shipping Methods. 1. Click "New Shipping Method". 1. In the Name field, enter the following XSS payload: html <img src=x onerror=alert('XSSShipping')> 1. Save the Shipping Method. 1. Place a new order or edit an existing order. 1. Set the order's Shipping Method to the one created in the previous steps. 1. Navigate to the Orders index page (/admin/commerce/orders). 1. Double-click the target order to open the details slideout. 1. Result: The XSS payload executes.
Other sources
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29177?
CVE-2026-29177 has a severity rating that indicates a Stored XSS vulnerability which can lead to significant security risks.
How do I fix CVE-2026-29177?
To fix CVE-2026-29177, update to Craft Commerce version 5.5.3 or 4.10.2 or later.
What kind of vulnerability is CVE-2026-29177?
CVE-2026-29177 is a Stored Cross-Site Scripting (XSS) vulnerability.
What is affected by CVE-2026-29177?
CVE-2026-29177 affects Craft Commerce versions between 4.0.0 and 4.10.1, and 5.0.0 to 5.5.2.
What can attackers achieve with CVE-2026-29177?
Attackers can inject malicious JavaScript through specific fields in order details, potentially compromising user sessions and data.