Craft Commerce, the e‑commerce platform for Craft CMS, contains a stored XSS flaw that allows injected JavaScript to run within an administrator’s browser when the Shipping Categories Name or Description fields are viewed. The vulnerability stems from inadequate sanitization before rendering. Successful exploitation permits an attacker to hijack admin sessions, deface content, or broaden their influence over the site’s data, potentially leading to full administrative control.

The flaw affects Craft CMS Commerce versions 4.0.0‑RC1 through 4.10.0 and 5.0.0 through 5.5.1, covering all installations of the Shipping Categories feature presented in the Store Management panel.

The CVSS score of 6.2 denotes medium severity and the EPSS score of less than 1% indicates a very low yet non‑zero probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description it is inferred that the attack vector requires the attacker to create or modify a Shipping Category via the admin interface, after which the malicious script executes on subsequent admin‑panel views. Successful exploitation would most likely rely on existing administrative credentials or a compromise of a user with category‑creation rights.