CVE-2026-29173: 
PHP vulnerability analysis and mitigation

CVE-2026-29173 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS. It affects Craft Commerce versions 4.0.0–4.10.1 and 5.0.0–5.5.2. The vulnerability exists in the Order Status update workflow within the Commerce Orders Table, where the Order Status Name is rendered without proper HTML escaping. It was published on March 9, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Github Advisory, Craft Commerce Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the UpdateOrderStatus.php action class passed Order Status attributes — including name, color, and description — directly into JSON-encoded JavaScript output without HTML encoding (Patch Commit). An attacker with admin-level access can craft a malicious Order Status Name (e.g., <img src=x onerror="alert('Order Statuses XSS')">) that is stored in the database and later executed in the browsers of any user who views the Commerce Orders Table and triggers the "Update Order Status" dialog. Exploitation requires high privileges (admin access to create/edit Order Statuses) and passive user interaction from a victim viewing the orders table (Craft Commerce Advisory).

Successful exploitation allows a malicious admin to inject persistent JavaScript that executes in the browsers of other users — including other admins or store managers — who view the Commerce Orders Table. This can lead to session token theft, unauthorized actions performed on behalf of victims, manipulation of order data, and potential account takeover within the Craft CMS admin panel. Availability is not directly impacted, but confidentiality and integrity of the subsequent system (other users' sessions and data) are at low risk (Github Advisory).

A proof-of-concept (PoC) with detailed step-by-step reproduction instructions and a concrete XSS payload is publicly available in the GitHub Security Advisory (Craft Commerce Advisory). The EPSS score is approximately 0.018% (5th percentile), indicating a low probability of exploitation in the wild within 30 days. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Gain Admin Access: Log in to the Craft CMS admin panel with an account that has admin privileges, specifically the ability to create or edit Order Statuses in Craft Commerce.
2. Navigate to Order Statuses: Go to Commerce → Settings → Order Statuses.
3. Inject Malicious Payload: Create a new Order Status and set the Name field to a malicious XSS payload, e.g., <img src=x onerror="alert('Order Statuses XSS')">.
4. Save the Order Status: Save the crafted order status; the payload is now stored in the database.
5. Trigger Victim Execution: Wait for another user (e.g., a store manager or another admin) to navigate to Commerce → Orders, select any order from the orders table, click the Gear Icon, and then click "Update Order Status...".
6. Script Executes: When the "Update Order Status" dialog renders, the unescaped Order Status Name is injected into the page, causing the malicious script to execute in the victim's browser — enabling session token theft, credential harvesting, or further actions on behalf of the victim (Craft Commerce Advisory).

• Logs: Craft CMS admin access logs showing creation or modification of Order Statuses containing HTML tags or JavaScript event handlers (e.g., onerror, onload, <script>) in the Name, Color, or Description fields.
• Database: Order Status records in the database with values containing HTML entities or JavaScript payloads in the name, color, or description columns of the commerce order statuses table.
• Network: Unexpected outbound HTTP requests from admin users' browsers to external domains shortly after interacting with the Commerce Orders Table "Update Order Status" dialog, which may indicate data exfiltration (e.g., session cookies being sent to an attacker-controlled server).
• Browser/Application: JavaScript alert dialogs or unexpected behavior appearing when users open the "Update Order Status" modal in the Commerce Orders Table.

Upgrade Craft Commerce to version 4.10.2 (for the 4.x branch) or 5.5.3 (for the 5.x branch), which apply proper HTML encoding to Order Status name, color, and description fields before rendering them in JavaScript contexts (Patch Commit, Github Advisory). As a compensating control, restrict admin access to Order Status creation/editing to only fully trusted personnel. Additionally, implementing a strict Content Security Policy (CSP) header can reduce the impact of any XSS execution even if the vulnerability is present.

The vulnerability was reported by security researcher mHe4am and published by the Craft CMS team on March 9, 2026 (Craft Commerce Advisory). Automated CVE tracking services including VulDB, INCIBE-CERT, and CVEfeed.io indexed the vulnerability shortly after disclosure. No significant broader media coverage or notable community debate has been observed, consistent with the low severity rating and the high privilege requirement for exploitation.