# CVE-2026-47994: Adobe Commerce stored XSS in form fields

Source: https://junglewise.ai/threats/cve-2026-47994-adobe-commerce-stored-xss-in-form-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-47994 · Severity: high · CVSS 8.7 · Published 2026-07-14

Adobe Commerce, a popular e-commerce platform, is affected by a security flaw that allows attackers to inject malicious scripts into the website. An attacker with low-level account access can use this to target other users, including administrators, potentially stealing their login sessions or taking control of their accounts. This could lead to unauthorized access to customer data or the store's management interface.

Technologies: [Adobe Commerce](https://junglewise.ai/threats/technologies/commerce), [Adobe Commerce Webhooks Plugin](https://junglewise.ai/threats/technologies/commerce-webhooks-plugin), [Adobe Commerce B2b](https://junglewise.ai/threats/technologies/commerce-b2b), [Adobe Magento Open Source](https://junglewise.ai/threats/technologies/magento-open-source). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-47994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47994 being exploited in the wild.

**How severe is CVE-2026-47994?** High severity, with a CVSS score of 8.7, published 14 July 2026.

**Which products and versions are affected?** Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18; Adobe Commerce Webhooks Plugin <= 1.20.0; Adobe Commerce B2b <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18; Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.

**Is there a fix for CVE-2026-47994?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47994 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47994?** Check whether you run Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in Adobe Commerce, Magento Open Source, and related components. The flaw is caused by improper neutralization of input during web page generation, specifically within certain form fields. A remote attacker with low-privileged credentials can inject malicious JavaScript that is subsequently stored on the server. When a victim (such as an administrator) views the affected page, the script executes in their browser context. This can lead to session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability has been addressed in the July 2026 security updates.

## Affected products

- Adobe Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
- Adobe Adobe Commerce B2B <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
- Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
- Adobe Adobe Commerce Webhooks Plugin <= 1.20.0

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory

## References

- [https://helpx.adobe.com/security/products/magento/apsb26-73.html](https://helpx.adobe.com/security/products/magento/apsb26-73.html)

## Related threats

- [Adobe Commerce improper input validation in file write](https://junglewise.ai/threats/cve-2026-95631-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce improper input validation in security feature](https://junglewise.ai/threats/cve-2026-95630-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce stored XSS vulnerability in form fields](https://junglewise.ai/threats/cve-2026-92922-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce stored XSS in form fields](https://junglewise.ai/threats/cve-2026-92911-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce incorrect authorization security feature bypass](https://junglewise.ai/threats/cve-2026-92910-adobe-commerce-is-affected-by-an-incorrect-authorization)