CVE-2026-29176
1 advisory.
Packagist/craftcms/commerce CVE-2026-29176: medium
Craft Commerce has stored XSS in Inventory Location Name
Action: Upgrade craftcms/commerce to 5.5.3 or later.
composer require craftcms/commerce:5.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.5.3 | - |
Fixed versions
| 5.5.3 |
Sources
- osv: GHSA-wj89-2385-gpx3
- https://github.com/craftcms/commerce/security/advisories/GHSA-wj89-2385-gpx3
- https://nvd.nist.gov/vuln/detail/CVE-2026-29176
- https://github.com/craftcms/commerce/commit/da143df084563ddf0929d7c261bcc11d312e8004
- https://github.com/craftcms/commerce
CVE-2026-29176 · published · modified · JSON