VulnSocial

CVE-2026-29175Disclosure(craftcms / craft_commerce)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.

craftcms CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • craft_commerce

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
craftcms
Products
craft_commerce

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-10: 1Technical Details · 2026-03-10: 103-10
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • CVE@CVEnew
    Disclosure

    CVE-2026-29175 Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Tit… https://www.cve.org/CVERecord?id=CVE-2026-29175

    Post summary

    The text announces a stored XSS vulnerability in Craft Commerce prior to version 5.5.3, providing only the CVE record link and basic details without any PoC, exploit code, patch, or active exploitation evidence.

    00000160
    56.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcraftcmscraft_commerce-craft_cms-

Explore more

Back to dashboardcraftcms CVEscraft_commerce vulnerabilities