Executive brief
Craft Commerce has stored XSS in Inventory Location Name
Affected products
- Packagist craftcms/commerce
Junglewise Threat Intelligence
CVE-2026-29176: Craft Commerce has stored XSS in Inventory Location Name
CVE-2026-29176 · Severity: medium · CVSS 4 · Published 2026-03-10
Technologies: craftcms/commerce (Packagist). Vendors: Packagist.
Related threats
- Craft CMS Commerce SQL injection in Product and Variant queries
- Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
- Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
- Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation