En resumen
- CVE-2026-29177 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a craftcms/commerce, craft commerce (craftcms).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.22%, mayor que el 13.1% de las vulnerabilidades.
- Solución: actualizar a 4.10.2, 5.5.3 o posterior.
| Package | Affected versions | Patched versions |
|---|
| craftcms/commerce Packagist | ≥ 4.0.0, < 4.10.2≥ 5.0.0, < 5.5.3
| 4.10.25.5.3
|
| craft commerce | ≥ 4.0.0, < 4.10.2≥ 5.0.0, < 5.5.3
| 4.10.25.5.3
|
Description
Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.
Reproduction Steps
- Navigate to Commerce -> Store Management -> Shipping Methods.
- Click "New Shipping Method".
- In the Name field, enter the following XSS payload:
<img src=x onerror=alert('XSS_Shipping')>
- Save the Shipping Method.
- Place a new order or edit an existing order.
- Set the order's Shipping Method to the one created in the previous steps.
- Navigate to the Orders index page (
/admin/commerce/orders).
- Double-click the target order to open the details slideout.
- Result: The XSS payload executes.
NVD description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
Más vulnerabilidades de craftcms/commerce
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free