Description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | commerce | >= 4.0.0 < 4.10.2, >= 5.0.0 < 5.5.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/commerce | >= 4.0.0, < 4.10.2 | 4.10.2 | GHSA-mj32-r678-7mvp |
| Packagist | craftcms/commerce | >= 5.0.0, < 5.5.3 | 5.5.3 | GHSA-mj32-r678-7mvp |