CVE-2026-29173: Craft Commerce Stored XSS Vulnerability

CVE-2026-29173 Overview

CVE-2026-29173 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce, the ecommerce platform for Craft CMS. The vulnerability exists in the Order Status management functionality where the Order Status Name is rendered without proper escaping when a user attempts to update the Order Status from the Commerce Orders Table. This lack of input sanitization allows malicious script execution to occur within the administrative context.

Critical Impact

Authenticated administrators with Order Status management privileges can inject malicious scripts that execute in the context of other administrative users, potentially leading to session hijacking, administrative account compromise, or further privilege abuse within the Craft CMS environment.

Affected Products

• Craft Commerce versions prior to 4.10.2
• Craft Commerce versions prior to 5.5.3
• craftcms craft_commerce (all vulnerable versions for Craft CMS)

Discovery Timeline

• 2026-03-10 - CVE-2026-29173 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29173

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in the Order Status management interface of Craft Commerce. When administrators create or modify Order Status entries, the status name field does not properly sanitize or encode user-supplied input before rendering it back to the browser. Because the vulnerability is stored rather than reflected, the malicious payload persists in the database and executes each time another user views the affected Order Status within the Commerce Orders Table.

The attack requires authenticated access with privileges to modify Order Status settings, which limits the initial attack surface to administrative users. However, once injected, the payload can target any user who accesses the orders management interface, including higher-privileged administrators.

Root Cause

The root cause of this vulnerability is improper output encoding in the template rendering logic for Order Status names. When displaying the Order Status Name in the Commerce Orders Table interface, the application fails to apply appropriate HTML entity encoding or contextual escaping. This allows HTML and JavaScript content submitted through the Order Status Name field to be interpreted as executable code rather than being displayed as plain text.

Attack Vector

The attack vector for CVE-2026-29173 is network-based and requires an authenticated user with administrative privileges to the Craft Commerce backend. The attacker must have sufficient permissions to access and modify Order Status configurations. The attack flow involves:

1. An attacker with admin-level access navigates to the Order Status management section
2. The attacker creates or modifies an Order Status, injecting malicious JavaScript in the Name field
3. The payload is stored in the database without sanitization
4. When another administrator views the Commerce Orders Table, the malicious script executes in their browser session
5. The injected script can perform actions on behalf of the victim, steal session tokens, or redirect users to malicious sites

The vulnerability mechanism involves improper output encoding in the Order Status display template. When rendering the status name, the application fails to escape special HTML characters, allowing injected script tags or event handlers to execute. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-29173

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in Order Status name entries in the Craft Commerce database
• Unexpected script execution or browser console errors when accessing the Commerce Orders Table
• Order Status names containing suspicious characters such as <, >, script, onerror, or onload attributes

Detection Strategies

• Review audit logs for Order Status modifications, particularly those containing special characters or encoded payloads
• Implement content security policy (CSP) headers to detect and block inline script execution attempts
• Monitor database entries in the Order Status table for values containing HTML or JavaScript syntax

Monitoring Recommendations

• Enable detailed logging for administrative actions within Craft CMS and Craft Commerce
• Configure web application firewall (WAF) rules to alert on XSS payload patterns in form submissions
• Periodically audit Order Status configurations for anomalous or suspicious name values

How to Mitigate CVE-2026-29173

Immediate Actions Required

• Upgrade Craft Commerce to version 4.10.2 or later for the 4.x branch
• Upgrade Craft Commerce to version 5.5.3 or later for the 5.x branch
• Review existing Order Status entries for any suspicious content and sanitize as necessary
• Implement Content Security Policy headers to mitigate the impact of any existing XSS payloads

Patch Information

Craft CMS has released security patches addressing this vulnerability in Craft Commerce versions 4.10.2 and 5.5.3. The fixes implement proper output encoding for the Order Status Name field, ensuring that user-supplied content is rendered as plain text rather than executable HTML/JavaScript.

Relevant patch commits:

• Patch for version 4.x branch (commit 60cdc505c03b6fa2f59715e8c060114b66334afa)
• Patch for version 5.x branch (commit a2ea853935ef03297ea1298bdb0d8c55ec5daf7b)

For complete details, see the GitHub Security Advisory GHSA-mqxf-2998-c6cp.

Workarounds

• Restrict access to Order Status management functionality to only essential trusted administrators until patching is complete
• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads in form submissions
• Manually validate and sanitize all Order Status name entries in the database to remove any potentially malicious content

# Verify current Craft Commerce version
./craft commerce/about

# Update Craft Commerce via Composer
composer update craftcms/commerce

# Clear caches after update
./craft clear-caches/all