Craft Commerce has stored XSS in Craft Commerce Order Details Slideout

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes.

Reproduction Steps

1. Navigate to Commerce -> Store Management -> Shipping Methods.
2. Click "New Shipping Method".
3. In the Name field, enter the following XSS payload:

   <img src=x onerror=alert('XSS_Shipping')>
   

4. Save the Shipping Method.
5. Place a new order or edit an existing order.
6. Set the order's Shipping Method to the one created in the previous steps.
7. Navigate to the Orders index page (/admin/commerce/orders).
8. Double-click the target order to open the details slideout.
9. Result: The XSS payload executes.