Craft Commerce contains a stored XSS flaw in the Inventory Locations page; the Name field is output without HTML escaping, letting an attacker inject arbitrary JavaScript. When an administrator or a user with product editing rights creates or edits a variant product, the malicious script runs in the browser of any user who views the location, potentially allowing data theft, session hijacking, or defacement.

The vulnerability affects all deployments of Craft Commerce for Craft CMS running any release prior to version 5.5.3. This includes all users who manage inventory locations or edit product variants.

The CVSS score of 4.8 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, implying no public knowledge of exploits. Based on the description, it is inferred that the attack vector requires an authenticated session with the permissions to edit inventory locations, typically granted to administrators or product editors. An attacker could thereby embed malicious code into the location name and cause it to execute for any subsequent viewer.