CVE-2026-29176

MEDIUM

Craft Commerce 5.0.0-5.5.2 - Stored Cross-Site Scripting in Inventory Locations Name Field

Title source: llm

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3.

References (2)

Core 2

Core References

Patch x_refsource_misc

https://github.com/craftcms/commerce/commit/da143df084563ddf0929d7c261bcc11d312e8004

View Patch ZIP pw:eip

Vendor Advisory x_refsource_confirm

https://github.com/craftcms/commerce/security/advisories/GHSA-wj89-2385-gpx3

Scores

CVSS v3 4.8

EPSS 0.0023

EPSS Percentile 14.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

craftcms/craft_commerce 5.0.0 - 5.5.3

Published Mar 10, 2026

Tracked Since Mar 11, 2026