CVE-2026-10769

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

PUBLISHED Reserved 2026-06-03 | Published 2026-07-10 | Updated 2026-07-14 | Assigner drupal

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Product status

Credits

Brian Willows (hsjbrianwillows) finder

Jonathan Sacksick (jsacksick) remediation developer

Greg Knaddison (greggles) coordinator

Lee Rowlands (larowlan) coordinator

Dave Long (longwave) coordinator

Juraj Nemec (poker10) coordinator

References

www.drupal.org/sa-contrib-2026-041

cve.org (CVE-2026-10769)

nvd.nist.gov (CVE-2026-10769)

Download JSON