Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table

Summary

A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur.

---

Proof of Concept

Required Permissions

• Admin access (to edit/create Order Statuses)

Steps to Reproduce

1. Log in with an admin account
2. Navigate to Commerce → Settings → Order Statuses
3. Create a new order status
4. Set the Name field to:

<img src=x onerror="alert('Order Statuses XSS')">

5. Save the order status
6. Go to Commerce → Orders (make sure you placed any orders)
7. From the left panel, select any Order Status (e.g., New)
8. Select any order from the orders table → Click on the Gear Icon → then click "Update Order Status..."
9. Notice the XSS execution