PT-2026-6417 · Packagist · Craftcms/Commerce
Published
2026-02-02
·
Updated
2026-02-02
CVSS v4.0
6.2
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N |
Summary
A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard.
Users are recommended to update to the patched 5.5.2 release to mitigate the issue.
Proof of Concept
Required Permissions
- Admin access (to edit/create Order Statuses)
Steps to Reproduce
- Log in with an admin account
- Navigate to Commerce → Settings → Order Statuses
- Create new order status (e.g., "Pending")
- Set the Name field to:
<img src=x onerror="alert('Order Statuses XSS')" hidden>- Save the order status
- Go to Commerce Orders & make some orders with different statuses (e.g. "New" & "the malicious created status")
- Go to the Dashboard (
/admin/dashboard) & Add "Recent Orders" widget and pick the same 2 statuses for orders - Notice the XSS execution
Technical Details
File:
vendor/craftcms/commerce/src/templates/ components/widgets/orders/recent/body.twigRoot Cause: 
value.name (the Order Status Name) is concatenated directly into the HTML string without sanitization. When JavaScript inserts this HTML into the DOM, any malicious tags/scripts in the name are executed.Mitigation
Use
Craft.escapeHtml() in the callback:callback: function(value) {
return '<span class="commerceStatusLabel"><span class="status ' + Craft.escapeHtml(value.color) + '"></span>' + Craft.escapeHtml(value.name) + '</span>';
}Resources:
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Craftcms/Commerce