GHSA-mqxf-2998-c6cp Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table

• Packagist craftcms/commerce: >= 4.0.0, < 4.10.2 → fixed in 4.10.2 • Packagist craftcms/commerce: >= 5.0.0, < 5.5.3 → fixed in 5.5.3

Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions • Admin access (to edit/create Order Statuses) Steps to Reproduce 1. Log in with an admin account 2. Navigate to Commerce → Settings → Order Statuses 3. Create a new order status 4. Set the Name field to: ```html ``` 5. Save the order status 6. Go to Commerce → Orders (make sure you placed any orders) 7. From the left panel, select any Order Status (e.g., New) 8. Select any order from the orders table → Click on the Gear Icon → then click "Update Order Status..." 9. Notice the XSS execution