PT-2026-24629 · Packagist · Craftcms/Commerce

Published 2026-03-10 · Updated 2026-03-10

OSV

CVSS v4.0

1.9

Low

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.

Reproduction Steps

1. Navigate to Commerce -> Store Management -> Shipping Methods.
2. Click "New Shipping Method".
3. In the Name field, enter the following XSS payload:

<img src=x onerror=alert('XSS Shipping')>

1. Save the Shipping Method.
2. Place a new order or edit an existing order.
3. Set the order's Shipping Method to the one created in the previous steps.
4. Navigate to the Orders index page (/admin/commerce/orders).
5. Double-click the target order to open the details slideout.
6. Result: The XSS payload executes.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-MJ32-R678-7MVP

Affected Products

Craftcms/Commerce

References · 5

• https://osv.dev/vulnerability/GHSA-mj32-r678-7mvp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29177 · Security Note
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp · Note
• https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a · Note