CVE-2026-29177

Description

## Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the **Shipping Method Name**, **Order Reference**, or **Site Name**. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. ## Reproduction Steps 1. Navigate to **Commerce** -> **Store Management** -> **Shipping Methods**. 1. Click "New Shipping Method". 1. In the **Name** field, enter the following XSS payload: ```html <img src=x onerror=alert('XSS_Shipping')> ``` 1. Save the Shipping Method. 1. Place a new order or edit an existing order. 1. Set the order's **Shipping Method** to the one created in the previous steps. 1. Navigate to the **Orders** index page (`/admin/commerce/orders`). 1. Double-click the target order to open the details slideout. 1. **Result**: The XSS payload executes.

How to fix CVE-2026-29177

To remediate CVE-2026-29177, upgrade the affected package to a fixed version below.

• —upgrade to 4.10.2 or later

Is CVE-2026-29177 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 4.0.0, < 4.10.2

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-29177
• PATCHgithub.com/craftcms/commerce
• WEBgithub.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a
• WEBgithub.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp