Craft Commerce is an ecommerce platform for Craft CMS.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 10, 2026 · NIST NVD

   Detected

   Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnera

2. Jun 17, 2026 · NIST NVD

   Updated

   Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnera

Affected

• cpe craftcms/craft commerceversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-29176

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-29176

  Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS tr

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com