Craft Commerce allows malicious JavaScript to be stored in the Address Line 1 field of Inventory Locations because input is not sanitized before display in the admin interface. This stored XSS flaw is a CWE‑79 vulnerability that lets an attacker execute code in an administrator’s browser, potentially compromising the admin’s session, extracting credentials, or performing other malicious actions within the Craft CMS backend.

The affected product is Craft Commerce for Craft CMS. Versions 4.0.0‑RC1 through 4.10.0 inclusive, and 5.0.0 through 5.5.1 inclusive are vulnerable. The flaw is patched in 4.10.1 and 5.5.2 and later releases.

The vulnerability carries a moderate CVSS score of 6.1 and a very low EPSS score of less than 1 %, indicating limited exploitation likelihood at present. It is not listed in the CISA KEV catalogue. The attack requires the ability to insert or modify an inventory location’s address field, which, based on the description, is inferred to require authenticated administrative access. Once the malicious script is stored, any administrator who views the inventory location will have the script executed in their browser, enabling potential credential theft, session hijacking, or other escalation of privilege within the Craft CMS admin panel.