Description

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-11T18:17:31.150Z",
  "pubdate": "2026-08-11T18:17:31.150Z",
  "executiveSummary": "Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that enables low-privileged authenticated attackers to inject persistent malicious scripts into vulnerable form fields. When targeted administrative or user interfaces render the stored input, the injected JavaScript executes within the context of the victim browser session. This vulnerability presents significant risk implications, as successful exploitation can lead to unauthorized session hijacking, account takeover, and potential escalation of privileges within the application environment. The attack requires authenticated access with low privileges and relies on user interaction, specifically requiring a victim to navigate to the compromised page containing the stored malicious payload. The security scope is categorized as changed, indicating that the vulnerability can impact resources beyond the initial administrative or security boundary of the affected component.",
  "technicalDetails": "The vulnerability is rooted in insufficient input sanitization and improper output encoding of user-supplied data accepted within form fields in Adobe Commerce. Because the application fails to adequately neutralize executable content before storing it in the backend database, malicious payloads persist across requests. The affected component involves form handling modules that process and subsequently render user input without contextual escaping.\nExploitation requires a low-privileged attacker to authenticate to the application and submit a crafted payload containing malicious JavaScript into vulnerable form fields. The application accepts this input and stores it persistently. The attack flow reaches its execution phase when a victim, such as a higher-privileged user or administrator, browses to the specific page containing the rendered form data. The browser interprets the stored payload as legitimate script content and executes it within the victim session.\nThe network exposure encompasses the web interface of Adobe Commerce. Because the script executes in the victim browser, the payload behavior includes accessing DOM elements, reading sensitive session tokens, and performing unauthorized actions on behalf of the victim. The post-exploitation impact includes potential administrative account compromise, session manipulation, and broader operational control over the vulnerable instance."
}