CVE-2026-10769 is a stored cross-site scripting vulnerability in Drupal Commerce Core caused by improper input neutralization during web page generation. This vulnerability affects Commerce Core versions from 3.3.0 to 3.3.6, allowing attackers to inject and store malicious scripts that execute in the context of users' browsers. The vulnerability is categorized under CWE-79. No CVSS score or vendor advisory with remediation details is available at this time.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the browsers of users visiting affected Drupal Commerce Core sites. This can lead to session hijacking, defacement, or redirection to malicious sites. However, no known exploits are reported in the wild, and the exact impact depends on the context of the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal's official channels for updates. Until a patch is available, consider applying input validation or output encoding workarounds if feasible.