CVE-2026-29175
1 advisory.
Packagist/craftcms/commerce CVE-2026-29175: high, EPSS 0.26%
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
Action: Upgrade craftcms/commerce to 5.5.3 or later.
composer require craftcms/commerce:5.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.5.3 | - |
Fixed versions
| 5.5.3 |
Sources
- osv: GHSA-cfpv-rmpf-f624
- https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624
- https://nvd.nist.gov/vuln/detail/CVE-2026-29175
- https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a
- https://github.com/craftcms/commerce
CVE-2026-29175 · published · modified · JSON