Craft Commerce, an ecommerce module for Craft CMS, contains a stored cross‑site scripting flaw in the “Name” field of tax rates within the Store Management section. The input is accepted without proper sanitization, allowing an attacker to embed malicious JavaScript that executes in the browser of any administrator who views the affected tax rate. Because the code runs with the privileges of the admin interface, an attacker can steal session cookies, modify data, or further compromise the system, effectively escalating privileges within the application.

Vendors affected are Craft CMS Commerce. The vulnerability is present in all releases from 4.0.0‑RC1 through 4.10.0 and from 5.0.0 through 5.5.1. The problem was addressed in version 4.10.1 and in version 5.5.2. Any installations running an earlier version of either major release line are at risk. The affected component is the Tax Rates name field supplied by administrators via the back‑office UI.

On the CVSS scale the score is 6.1, indicating a moderate severity. The EPSS value is below 1 %, suggesting a low probability of exploitation at this time, and the vulnerability has not yet appeared in the CISA KEV catalog. Because the flaw requires a privilege to insert or edit tax rates, the attack vector is mainly through authenticated access to the commerce back‑office. An attacker who can create or modify a tax rate can place a payload that later runs when a legitimate administrator opens the rate, leading to client‑side code execution in the admin context.