Craft Commerce includes a stored cross‑site scripting flaw in the Shipping Zone Name and Description fields. Attackers can inject malicious JavaScript that is rendered unchanged when an administrator views the shipping zone records. This vulnerability enables attackers to steal session cookies, perform actions in the context of the logged‑in admin, and potentially gain broader access to the site. The primary impact is accidental execution of arbitrary scripts in the privileged administrator’s browser, undermining confidentiality and integrity of administrative sessions. The weakness is identified as CWE‑79.

Craft CMS Commerce versions 4.0.0‑RC1 through 4.10.0 and 5.0.0 through 5.5.1 are affected. The defect was patched in Craft Commerce 4.10.1 and subsequent 5.x releases starting at 5.5.2.

The CVSS score of 6.1 indicates a moderate severity, and an EPSS probability of less than one percent suggests the vulnerability is unlikely to be widely exploited in the near term. Craft CMS Commerce is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must first obtain the ability to write to a shipping zone—typically by having administrator privileges or by compromising an account with such rights. Once the payload is stored, any later admin visitor triggers the script. Since the flaw exploits input validation and output escaping, it is relatively straightforward for an attacker to inject malicious JavaScript if the required write access is obtained.