The vulnerability is a stored cross‑site scripting flaw where the Shipping Methods Name field in Craft Commerce is not properly escaped before rendering in the admin panel. A malicious payload entered in that field can execute arbitrary JavaScript in any administrator who views the shipping method, enabling actions such as credential theft, session hijacking, or further privileged tampering. The flaw is classified as CWE‑79.

Craft Commerce, a plugin for Craft CMS, is affected in all releases from version 5.0.0 through 5.5.1. The issue is fixed in version 5.5.2 and later.

The CVSS score is 6.1, indicating moderate severity. The EPSS score is below 1%, showing a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The most likely attack vector is a web‑based interaction where an attacker can create or modify a shipping method with malicious content and then lure an administrator to view it. Successful exploitation requires that an attacker can inject content into the shipping method name field and that an authenticated administrator views the field.