Honestly, why XML? Isn't JSON 100 times better, smaller and easy to use than XML? why choose a legacy format (with known security problems in parsers, compability, and unnecessary use of bandwidth) in 2022?
Firstly, I can not trust open source e-commerce softwares for use in production. Lots of them have security bugs. But if you wanna use open source solution, TomatoCart looks nice.