Aikido Intel
Secure My Code
Intel

AIKIDO-2024-10272

craftcms/commerce is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Sep 16, 2024

30

Low Risk

This Affects:

phpcraftcms/commerce
4.0.0 - 4.6.10
Fixed in 4.6.11
5.0.0 - 5.1.0.1
Fixed in 5.1.1
Are you affected? Scan for Free

TL;DR

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) on the OrderElementTrait.php page.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

craftcms/commerce is vulnerable to Cross-site Scripting (XSS) in versions 4.0.0 - 4.6.10 and 5.0.0 - 5.1.0.1.

How to fix this

Upgrade the craftcms/commerce library to the patch version.

Links

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free
Book a Demo

Free. No credit card required.

Aikido Platform
Subscribe
Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

LinkedIn YouTube X
© 2026 Aikido Security BV | BE0792914919
Ghent, Belgium | San Francisco, US
SOC 2SOC 2Compliant
ISO 27001ISO 27001Compliant
ISO 42001ISO 42001Compliant
FedRAMPFedRAMPImplementing

© All Intel data is openly available and commercially licensed.