GHSA-MJ32-R678-7MVP

Vulnerability from github – Published: 2026-03-10 18:24 – Updated: 2026-03-10 22:55
VLAI?
Summary
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Details

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.

Reproduction Steps

  1. Navigate to Commerce -> Store Management -> Shipping Methods.
  2. Click "New Shipping Method".
  3. In the Name field, enter the following XSS payload: html <img src=x onerror=alert('XSS_Shipping')>
  4. Save the Shipping Method.
  5. Place a new order or edit an existing order.
  6. Set the order's Shipping Method to the one created in the previous steps.
  7. Navigate to the Orders index page (/admin/commerce/orders).
  8. Double-click the target order to open the details slideout.
  9. Result: The XSS payload executes.
Severity ?
1.9 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.10.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.5.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29177"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-10T18:24:18Z",
    "nvd_published_at": "2026-03-10T20:16:39Z",
    "severity": "LOW"
  },
  "details": "## Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the **Shipping Method Name**, **Order Reference**, or **Site Name**. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.\n\n## Reproduction Steps\n1. Navigate to **Commerce** -\u003e **Store Management** -\u003e **Shipping Methods**.\n1. Click \"New Shipping Method\".\n1. In the **Name** field, enter the following XSS payload:\n    ```html\n    \u003cimg src=x onerror=alert(\u0027XSS_Shipping\u0027)\u003e\n    ```\n1. Save the Shipping Method.\n1. Place a new order or edit an existing order.\n1. Set the order\u0027s **Shipping Method** to the one created in the previous steps.\n1. Navigate to the **Orders** index page (`/admin/commerce/orders`).\n1. Double-click the target order to open the details slideout.\n1. **Result**: The XSS payload executes.",
  "id": "GHSA-mj32-r678-7mvp",
  "modified": "2026-03-10T22:55:02Z",
  "published": "2026-03-10T18:24:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29177"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/commerce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft Commerce has stored XSS in Craft Commerce Order Details Slideout"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.