Skip to content
OpenAdvisories

Product · craftcms

commerce

21 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 1.7
    CVE-2026-32270

    Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments

    Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails du…

    craftcms commerce craftcms/commerce Packagist
  • Low 1.9
    CVE-2026-29177

    Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

    Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference,…

    craftcms commerce craftcms/commerce Packagist
  • Low 1.9
    CVE-2026-29173

    Craft Commerce has Stored XSS while updating Order Status from Orders Table

    Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowin…

    craftcms commerce craftcms/commerce Packagist