{"id":"CVE-2026-29176","aliases":["GHSA-wj89-2385-gpx3"],"url":"https://o3.security/vulnerability/CVE-2026-29176","summary":"Craft Commerce has Stored XSS in Inventory Location Name","details":"## Summary\nA stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The **Name** field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript.\n\nThis XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product.\n\n## Proof of Concept\n\n### Permissions Required\n- General\n    - Access the control panel\n    - Access Craft Commerce\n\n- Craft Commerce\n    - Manage inventory locations\n\n### Steps to Reproduce\n\n1. Log in to the control panel\n2. Navigate to **Commerce → Inventory Locations**\n3. Create or edit a location\n4. Set **Name** to the following payload:\n    ```html\n    <img src=x onerror=\"alert('XSS')\">\n    ```\n5. Save the location\n6. Navigate to **Commerce → Products** and click \"New Product\" and click \"New product variant\"\n7. The Inventory Location table loads, rendering the **Inventory Location Name**\n8. XSS executes\n\n## Impact\n- Potential Session Hijacking\n- Potential Database Exfiltration\n- Potential Account Takeover by forcing a password change on the victim’s account.\n- Potential Privilege escalation, or creating new admin users.\n\n## Mitigation\nSanitize the inventory location name field when rendering in the \"Track Inventory\" table.","published":"2026-03-10T19:59:48.366Z","modified":"2026-10-28T02:30:46.436916791Z","cvss":null,"epss":{"score":0.00234,"percentile":0.14475,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.5.3"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/da143df084563ddf0929d7c261bcc11d312e8004","label":"craftcms/commerce@da143df"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29176.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-wj89-2385-gpx3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29176"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/da143df084563ddf0929d7c261bcc11d312e8004"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:46.436916791Z"}}