{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-14T07:07:18.501","vulnerabilities":[{"cve":{"id":"CVE-2026-29177","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T20:16:39.037","lastModified":"2026-03-11T15:07:13.647","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3."},{"lang":"es","value":"Craft Commerce es una plataforma de comercio electrónico para Craft CMS. Antes de 4.10.2 y 5.5.3, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en los detalles de pedidos de Craft Commerce. JavaScript malicioso puede ser inyectado a través del Nombre del Método de Envío, la Referencia del Pedido o el Nombre del Sitio. Cuando un usuario abre el panel deslizante de detalles del pedido mediante un doble clic en la página de índice de pedidos, la carga útil inyectada se ejecuta. Esta vulnerabilidad está corregida en 4.10.2 y 5.5.3."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.10.2","matchCriteriaId":"21ABE060-9AA9-4E13-A387-89028A7D990F"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.5.3","matchCriteriaId":"2690BD5E-2A88-4CDC-AAD6-DD02B96E1A46"}]}]}],"references":[{"url":"https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}