← Vulnerability feed

Vulnerability record · CVE-2026-29173 · published 10 March 2026

CVE-2026-29173: Craftcms craft commerce cross-site scripting vulnerability

Craftcms · Craft Commerce

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.

1.9 CVSS 4.0 Low EPSS 0.37% · top 71.2% CWE-79 · Cross-site scripting
1.9CVSS 4.0 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b66334afa Patch
https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b Patch
https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cp ExploitVendor Advisory

Track CVE-2026-29173 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-29174Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table da…EPSS 0.52%8.7CVE-2026-29172Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables t…EPSS 0.52%8.6CVE-2026-29175Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product T…EPSS 0.25%6.3CVE-2026-31867Craftcms craft commerce insecure direct object reference vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in …EPSS 0.32%6.2CVE-2026-25485Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.39%6.2CVE-2026-25482Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability e…EPSS 0.46%6.2CVE-2026-25483Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exist…EPSS 0.44%6.1CVE-2026-25522Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2026-29173), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.