Craft Commerce versions 4.0.0‑RC1 through 4.10.0 and 5.0.0 through 5.5.1 allow stored XSS via the Name and Description fields of Tax Categories in the Store Management section. The input in these fields is not sanitized before being rendered in the admin panel, enabling an attacker to inject JavaScript that executes with the privileges of the logged‑in administrator. An attacker could steal session cookies, gain elevated access, or modify site content, providing a foothold for broader compromise.

Affected vendors include CraftCMS Commerce. In particular, Craft Commerce releases 4.0.0‑RC1 to 4.10.0 and 5.0.0 to 5.5.1 are vulnerable. The vulnerability is fixed in releases 4.10.1 and 5.5.2 and later. All other versions are unaffected.

The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low, and the item is not listed in the CISA KEV catalog. Exploitation requires the attacker to either authenticate as an administrator or otherwise find a path to edit Tax Category entries; thus it is likely to be limited to compromised or vulnerable admin accounts. If the attacker gains such access, arbitrary JavaScript execution could lead to credential theft and privilege escalation within the Craft CMS environment.