{"id":"CVE-2026-29173","aliases":["GHSA-mqxf-2998-c6cp"],"url":"https://o3.security/vulnerability/CVE-2026-29173","summary":"Craft Commerce has Stored XSS while updating Order Status from Orders Table","details":"## Summary\nA stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur.\n\n---\n## Proof of Concept\n### Required Permissions\n- Admin access (to edit/create Order Statuses)\n\n### Steps to Reproduce\n1. Log in with an admin account\n2. Navigate to **Commerce** → **Settings** → **Order Statuses**\n3. Create a new order status\n4. Set the **Name** field to:\n```html\n<img src=x onerror=\"alert('Order Statuses XSS')\">\n```\n5. Save the order status\n6. Go to Commerce → Orders (make sure you placed any orders)\n7. From the left panel, select any Order Status (e.g., New)\n8. Select any order from the orders table → Click on the Gear Icon → then click \"Update Order Status...\"\n9. Notice the XSS execution","published":"2026-03-10T19:54:25.064Z","modified":"2026-08-12T03:51:16.760546738Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"4.10.2"},{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.5.3"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b66334afa","label":"craftcms/commerce@60cdc50"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29173.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29173"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b66334afa"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.760546738Z"}}