1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29177

CVE-2026-29177: Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.

Reproduction Steps

Navigate to Commerce -> Store Management -> Shipping Methods.
Click "New Shipping Method".
In the Name field, enter the following XSS payload:
```
<img src=x onerror=alert('XSS_Shipping')>
```
Save the Shipping Method.
Place a new order or edit an existing order.
Set the order's Shipping Method to the one created in the previous steps.
Navigate to the Orders index page (/admin/commerce/orders).
Double-click the target order to open the details slideout.
Result: The XSS payload executes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29177

CVE-2026-29177:

1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 4.0.0, <= 4.10.1	4.10.2
craftcms/commerce	composer	>= 5.0.0, <= 5.5.2	5.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored XSS in the Craft Commerce order details slideout. The root cause is the lack of output encoding for several fields related to an order. The provided patch addresses this by adding Html::encode() to the getMetadata function within the src/elements/Order.php file. This function gathers various pieces of information about an order, including the 'Reference', 'Order Site', and 'Shipping Method', which are explicitly mentioned as injection vectors in the vulnerability description. By observing the changes in the commit, it's clear that the getMetadata function was the source of the unescaped data. When the application's frontend would render the data returned by this function, any injected scripts would be executed. Therefore, craftcms\commerce\elements\Order::getMetadata is the vulnerable function that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

craftcms\commerce\elements\Order::getMetadata

src/elements/Order.php

The `getMetadata` function in the `Order` element is responsible for preparing an order's data for display, including in the order details slideout. The vulnerability description states that malicious JavaScript can be injected via the 'Shipping Method Name', 'Order Reference', or 'Site Name'. The patch for this vulnerability adds HTML encoding to these exact fields within this function. Before the patch, the function returned raw, unescaped data, which would then be rendered in the UI, leading to a stored Cross-Site Scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.