Craft Commerce stored cross‑site scripting (XSS) occurs when product type names entered by users are displayed without sanitization in CMS user permissions settings. The vulnerability allows an attacker to inject arbitrary JavaScript that executes in the context of the permission‑editing page, permitting payload execution as long as the user can edit product types and view permission settings. The injected code can lead to session hijacking, credential theft, or defacement of the admin interface.

The flaw affects Craft Commerce for Craft CMS versions from 4.0.0‑RC1 through 4.10.0 and from 5.0.0 through 5.5.1. Versions 4.10.1 and 5.5.2 contain a patch that sanitizes product type names before rendering in permission settings, eliminating the stored XSS vector.

The CVSS v3 score is 4.8, providing medium severity, while the EPSS score is below 1%, indicating a low likelihood of public exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires access to the product‑type management interface; an attacker with that privilege can inject scripts that will run for any user who subsequently views the permissions page.