The vulnerability resides in Craft Commerce, where product titles, variant titles, and variant SKUs displayed on the inventory page are rendered without proper HTML escaping. An attacker can store malicious JavaScript in these fields, which then executes when any user—including administrators—accesses the inventory management screen. The injected script can steal session cookies or hijack the administrator’s session, allowing full control over the ecommerce site. This is a classic stored XSS flaw (CWE-79).

The affected product is Craft Commerce, built on Craft CMS, for all deployments using versions earlier than 5.5.3. The flaw exists in every instance of the inventory page regardless of installation size or scale, so any server running an unsupported build is vulnerable. The fix is available in version 5.5.3, which applies proper escaping to the affected fields.

The CVSS v3.1 score of 8.6 classifies the issue as high severity. EPSS indicates an exploitation probability of less than 1 %, suggesting that widespread public exploitation has not yet been observed, but the still–high CVSS underscores the potential damage. The vulnerability is not present in the CISA KEV catalog, but since it requires storing malicious input that is later rendered, the most likely attack vectors involve an attacker who can add or edit product or variant details so that the malicious code is stored, or an attacker who lures an administrator to view an item containing the injected code. Given the exposure of the panel for privileged accounts, the risk to confidentiality, integrity, and availability of the ecommerce platform remains significant.