CVE-2026-29173 - Vulnerability Analysis

Overview

Craft Commerce < 4.10.2 and < 5.5.3 contains a stored XSS caused by improper escaping of Order Status Name in Commerce Orders Table, letting attackers execute scripts, exploit requires user to update order status.

Severity & Score

Impact

Attackers can execute scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Mitigation

Update to versions 4.10.2 or 5.5.3 or later.

References

• https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b66334afa
• https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b
• https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner