CVE-2026-29177 | Craft Commerce up to 4.10.2/5.5.3 Order Details Shipping Method Name/Order Reference/Site Name cross site scripting (GHSA-mj32-r678-7mvp)

A vulnerability labeled as problematic has been found in Craft Commerce up to 4.10.2/5.5.3. Affected by this vulnerability is an unknown functionality of the component Order Details Handler. The manipulation of the argument Shipping Method Name/Order Reference/Site Name results in cross site scripting.

This vulnerability is reported as CVE-2026-29177. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.