https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 04:10:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275348 EUVD-2026-275348 https://cve.radiocsirt.org/vuln/euvd-2026-275348 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29177 <p>Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.</p> <p>Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29177 https://cve.radiocsirt.org/vuln/ghsa-mj32-r678-7mvp <p><strong>Affected:</strong> Packagist: craftcms/commerce</p> <p>## Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the **Shipping Method Name**, **Order Reference**, or **Site Name**. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.</p> <p>## Reproduction Steps 1. Navigate to **Commerce** -&gt; **Store Management** -&gt; **Shipping Methods**. 1. Click &#34;New Shipping Method&#34;. 1. In the **Name** field, enter the following XSS payload: ```html &lt;img src=x onerror=alert(&#39;XSS_Shipping&#39;)&gt; ``` 1. Save the Shipping Method. 1. Place a new order or edit an existing order. 1. Set the order&#39;s **Shipping Method** to the one created in the previous steps. 1. Navigate to the **Orders** index page (`/admin/commerce/orders`). 1. Double-click the target order to open the details slideout. 1. **Result**: The XSS payload executes.</p> <p><strong>Affected:</strong> Packagist: craftcms/commerce</p> <p>## Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the **Shipping Method Name**, **Order Reference**, or **Site Name**. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.</p> <p>## Reproduction Steps 1. Navigate to **Commerce** -&gt; **Store Management** -&gt; **Shipping Methods**. 1. Click &#34;New Shipping Method&#34;. 1. In the **Name** field, enter the following XSS payload: ```html &lt;img src=x onerror=alert(&#39;XSS_Shipping&#39;)&gt; ``` 1. Save the Shipping Method. 1. Place a new order or edit an existing order. 1. Set the order&#39;s **Shipping Method** to the one created in the previous steps. 1. Navigate to the **Orders** index page (`/admin/commerce/orders`). 1. Double-click the target order to open the details slideout. 1. **Result**: The XSS payload executes.</p> https://cve.radiocsirt.org/vuln/ghsa-mj32-r678-7mvp