Executive brief
Adobe Commerce, a popular e-commerce platform used for managing online stores, is affected by a security vulnerability that allows the injection of malicious scripts. An attacker with high-level administrative privileges can insert code into certain form fields that will execute in the browser of other users, such as other administrators. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Adobe Commerce due to improper neutralization of input during web page generation (CWE-79). A high-privileged attacker can exploit this by injecting malicious JavaScript into vulnerable form fields within the application. The attack requires the victim to interact with the application by browsing to the specific page containing the injected field. Because the vulnerability is 'stored', the payload remains on the server and executes in the context of any user who views the affected page. The CVSS score of 4.8 reflects that while the impact is significant (Scope change), it requires high privileges to initiate the attack.
Affected products
- Adobe Commerce 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory