Improper neutralization of input during web page generation in Drupal Commerce Core allows stored XSS. An attacker can embed malicious script code into product data or other storefront fields that are later rendered to site visitors. When a visitor loads the affected page, the script executes in the visitor’s browser, enabling client‑side attacks. This weakness is identified as CWE‑79.

Drupal Commerce Core versions 3.3.0 through 3.3.6 are affected. Based on the description, it appears the vulnerability originates from code that stores user‑supplied data without proper escaping during page rendering.

The CVSS score of 5.4 indicates medium severity. The EPSS score is below 1%, reflecting a very low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to submit or modify content—e.g., via the commerce backend or a form—that stores malicious script for later rendering to visitors. The impact is limited to client‑side execution and does not grant server‑side code execution or privilege escalation.