CVE-2026-29177 - Vulnerability Analysis

Overview

Craft Commerce < 4.10.2 and < 5.5.3 contains a stored cross-site scripting caused by injection of malicious JavaScript via Shipping Method Name, Order Reference, or Site Name in order details, letting attackers execute scripts when users open order details slideout, exploit requires user interaction.

Severity & Score

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Mitigation

Update to versions 4.10.2 or 5.5.3 or later.

References

• https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a
• https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner