Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

Drupal's security team warned that attackers are actively exploiting CVE-2026-118539, an access-bypass vulnerability in the Commerce Core module.

Insufficient protection of routes and entity fields could allow unauthorized changes with financial consequences for merchants.

E-commerce operators may face fraudulent or inconsistent orders. Applying a patch alone may not reveal changes attackers already made.

Upgrade Commerce Core 3.x to 3.3.13 or the older supported branch to 8.x-2.41, then audit orders for inconsistencies.

Drupal explicitly identifies exploitation in the wild. The advisory does not establish how many stores have been compromised.