Medium severity · published Mar 10, 2026
CVE-2026-29175
Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commerce · craftcms
>= 5.0.0 < 5.5.3 · source: vendor
CC
Craft Commerce · Craftcms
5.0.0 before 5.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29175
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29175
Patch
https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a
Exploit
https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624
More from commerce
8.8
CVE-2026-29174
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
8.8
CVE-2026-29172
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
8.7
CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
7.7
CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
6.9
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass