Craft Commerce exposes a stored cross‑site scripting flaw in the Order Status History Message. The message is processed with the |md filter, which accepts raw HTML, so a malicious script can be embedded and executed whenever the message is viewed in a browser. This can compromise user credentials, customer personal data, order history, and even two‑factor recovery codes if the attacker also has backup‑utility permissions. The vulnerability represents a moderate severity threat; the script execution alone allows session hijacking and data theft, while the added backup‑utility access enables full database exfiltration.

Affected products are Craft CMS Commerce from the 4.x series (4.0.0‑RC1 to 4.10.0) and from the 5.x series (5.0.0 to 5.5.1). The vulnerability is resolved in releases 4.10.1 and 5.5.2.

The CVSS score is 6.2 and the EPSS is below 1 %, indicating a moderate technical severity but a low likelihood of observed exploitation. The flaw can be exploited by any authenticated user able to edit order status messages, even without elevated permissions, and a separate prerequisite—holding the database backup utility permission—enables the attacker to extract the entire database. Because the attack requires authenticated access to the backend, the risk depends on the organization’s role‑based access controls.