CVE-2026-10769

Drupal Commerce Core versions 3.3.0 through 3.3.6 are vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is a failure to sufficiently sanitize customer comments within the order receipt email template . This vulnerabi...