CVE-2026-10769
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was found in Drupal Commerce Core due to improper input neutralization during page generation. It affects versions from 3.3.0 to 3.3.6.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session theft, account takeover, or data leakage.
Recommendation
Immediately update Drupal Commerce Core to version 3.3.7 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Drupal Commerce Core
See all- CVE-2026-118544Low risk· EPSS 4%
An Exposure of Sensitive Information Through Data Queries vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118543Low risk· EPSS 2%
A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Commerce Core module allows unauthorized actions to be performed on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118542Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118541Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118540Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.2.0.
- CVE-2026-118539Medium
A Missing Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS