GHSA-mj32-r678-7mvp
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/commerce | >= 4.0.0, < 4.10.2 | 4.10.2 |
| Packagist | craftcms/commerce | >= 5.0.0, < 5.5.3 | 5.5.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the **Shipping Method Name**, **Order Reference**, or **Site Name**. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.
## Reproduction Steps
1. Navigate to **Commerce** -> **Store Management** -> **Shipping Methods**.
1. Click "New Shipping Method".
1. In the **Name** field, enter the following XSS payload:
```html
<img src=x onerror=alert('XSS_Shipping')>
```
1. Save the Shipping Method.
1. Place a new order or edit an existing order.
1. Set the order's **Shipping Method** to the one created in the previous steps.
1. Navigate to the **Orders** index page (`/admin/commerce/orders`).
1. Double-click the target order to open the details slideout.
1. **Result**: The XSS payload executes.
References
External links from the advisory. They lead to third-party sites.