Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table

Successful exploitation of CVE-2026-29173 allows an attacker to execute arbitrary JavaScript code in the context of an administrator's session. This could lead to account takeover, data exfiltration (including sensitive customer information), and defacement of the Commerce site. The impact is particularly severe as it targets administrative accounts, granting attackers a high level of control over the entire e-commerce platform. The attack leverages the lack of proper output encoding when rendering the Order Status Name, a common XSS vector. While the CVSS score is LOW, the potential for significant damage to the business and customer trust warrants immediate attention.

Organizations using Craft Commerce versions 4.9.4 and earlier, particularly those with limited security controls or inadequate input validation practices, are at significant risk. Sites with multiple administrator accounts or those handling sensitive customer data are especially vulnerable.

• php: Examine Craft Commerce application logs for suspicious POST requests to the Order Statuses endpoint with unusual characters in the Name field. • generic web: Use curl to test the Order Statuses endpoint with a payload like <script>alert('XSS')</script> and observe the response for JavaScript execution. • wordpress / composer / npm: N/A - This vulnerability is specific to the Craft CMS Commerce plugin. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability is not directly exploitable through database queries. • linux / server: N/A - This vulnerability is specific to the Craft CMS Commerce plugin and its PHP code. • windows / supply-chain: N/A - This vulnerability is specific to the Craft CMS Commerce plugin and its PHP code.

1. 2026-03-10Disclosure

   disclosure

1. Gereserveerd2026-03-04
2. Gepubliceerd2026-03-10
3. Gewijzigd2026-03-13
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-29173 is to upgrade Craft Commerce to version 4.10.2 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the Order Status Name field to prevent malicious script injection. Web Application Firewalls (WAFs) configured to detect and block XSS payloads targeting the Commerce Orders Table can provide an additional layer of protection. Regularly review and sanitize all user-supplied input to minimize the risk of XSS vulnerabilities.

Laatste update

5.6.5recent