Craft Commerce versions 4.0.0‑RC1 to 4.10.0 and 5.0.0 to 5.5.1 expose a stored DOM-based cross‑site scripting flaw in the Recent Orders dashboard widget. The Order Status Name is concatenated directly into JavaScript without escaping, enabling an attacker to inject arbitrary scripts that run whenever an administrator views the dashboard. This code executes with the privileges of the logged‑in admin, enabling actions such as session hijacking, credential theft, or lateral movement within the site.

Affected products are Craft CMS Commerce for the Craft CMS platform. The vulnerability applies to all releases from version 4.0.0‑RC1 up to and including 4.10.0, and from version 5.0.0 through 5.5.1. Earlier or later releases, including 4.10.1 and 5.5.2, contain the fix.

The CVSS score of 6.2 reflects moderate severity, and the EPSS indicates a less than 1% probability that exploitation is observed in the wild, meaning it is unlikely to be the target of current attacks. The flaw is not listed in the CISA KEV catalog, further suggesting limited exploitation. An attacker must first authenticate with administrator credentials to load the vulnerable page; once authenticated, any payload placed into an Order Status Name will execute immediately, granting the attacker the same in‑browser privileges as the admin. Thus, the risk is contingent on privileged access and the ability to modify order status names.