Craft Commerce includes a stored XSS flaw in the Order Details slideout. An attacker can inject malicious JavaScript through the Shipping Method Name, Order Reference, or Site Name fields. When an authorized user opens the order details by double‑clicking an order in the index page, the payload is rendered and executed in that user’s browser. This could lead to theft of session cookies, injection of further payloads, or unauthorized actions performed under the user’s identity.

The vulnerability is present in Craft Commerce releases prior to version 4.10.2 and 5.5.3. Any installation running an affected version of the e‑commerce plugin is susceptible.

TheSS score of 1.9 indicates a low severity assessment, and the EPSS score is below 1 %, suggesting a low probability of exploitation. It is not listed in CISA’s KEV catalog. The attack vector is likely restricted to users with permission to view order details, making exploitation dependent on administrative credentials.