Craft Commerce versions 4.0.0‑RC1 through 4.10.0 and 5.0.0 through 5.5.1 contain a stored cross‑site scripting flaw that arises when the Name or Description fields of Tax Zones are not properly sanitized. When an attacker injects malicious JavaScript into these fields, the code is executed in the browser of anyone who views the tax zone entries in the administrator control panel. This can allow session theft, phishing, or other malicious actions within the admin interface, effectively leading to privilege escalation or abuse of administrative privileges.

The vulnerability affects all installations of Craft CMS Commerce in the affected version ranges. Vendors include Craft CMS under the product name Craft Commerce. The impacted versions are 4.0.0‑RC1 to 4.10.0 and 5.0.0 to 5.5.1. Any deployment using those releases should verify the current version and assess whether the vulnerable tax zone data has been stored.

The CVSS score of 6.1 indicates medium severity, while the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require access to the administrator console, either through pre‑existing administrative credentials or successful compromise of an admin account, to submit malicious payloads into the vulnerable fields.