EIP-2026-114487

This is a technical writeup describing a stored XSS vulnerability in XT:Commerce < 3.04 SP2.1. The vulnerability allows an attacker to inject malicious JavaScript into the 'street' field during account creation, which executes when an administrator views the order in the backend.