Project: 
Commerce Custom Order Status
Date: 
2018-July-11
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Scripting
Description: 

Commerce Custom Order Status provides forms for administrators to add, edit, and delete order statuses from the order settings screen.

The module doesn't sufficiently sanitize the output of the status names.

This vulnerability is mitigated by the fact that an attacker must have a role with the "configure order settings" permission.

Solution: 

Install the latest version:

Also see the Commerce Custom Order Status project page.

Reported By: 
Fixed By: 
Coordinated By: