1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29173

CVE-2026-29173: Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table

Summary

A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur.

Proof of Concept

Required Permissions

Admin access (to edit/create Order Statuses)

Steps to Reproduce

Log in with an admin account
Navigate to Commerce → Settings → Order Statuses
Create a new order status
Set the Name field to:

<img src=x onerror="alert('Order Statuses XSS')">

Save the order status
Go to Commerce → Orders (make sure you placed any orders)
From the left panel, select any Order Status (e.g., New)
Select any order from the orders table → Click on the Gear Icon → then click "Update Order Status..."
Notice the XSS execution

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29173

CVE-2026-29173:

1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 4.0.0, <= 4.10.1	4.10.2
craftcms/commerce	composer	>= 5.0.0, <= 5.5.2	5.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches reveals a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce. The vulnerability is located in the getTriggerHtml method of the UpdateOrderStatus class. The provided commit 60cdc505c03b6fa2f59715e8c060114b66334afa clearly shows the fix. Before the patch, the code fetched order status data and passed it to the frontend without proper output encoding. An administrator could create an order status with a malicious payload in its name (e.g., <img src=x onerror=alert(1)>). When another user attempts to update an order's status, the getTriggerHtml function would be called, and the malicious name would be rendered in the HTML, executing the script. The patch addresses this by applying Html::encode() to the name, color, and description fields of the order status before it is JSON-encoded and sent to the client-side script. This ensures that any HTML in the order status name is treated as text and not interpreted by the browser, thus preventing the XSS attack. The vulnerable function is therefore craft\commerce\elements\actions\UpdateOrderStatus::getTriggerHtml.

Vulnerable functions

craft\commerce\elements\actions\UpdateOrderStatus::getTriggerHtml

src/elements/actions/UpdateOrderStatus.php

The vulnerability exists in the `getTriggerHtml` function. Before the patch, this function retrieved all order statuses and directly JSON-encoded them for use in a JavaScript context. It failed to sanitize the 'name' property of the order statuses. Since an administrator can set the order status name to a value containing malicious HTML and JavaScript, this would be rendered unescaped in the control panel when an order's status is updated, leading to a stored Cross-Site Scripting (XSS) vulnerability. The patch mitigates this by using `Html::encode()` on the order status properties before they are JSON-encoded.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.