Description

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-11T18:17:31.313Z",
  "pubdate": "2026-08-11T18:17:31.313Z",
  "executiveSummary": "Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that enables low-privileged malicious actors to inject arbitrary JavaScript payloads into vulnerable form fields. When targeted users browse to the affected application interface containing the persistent payload, the malicious script executes within the context of the victim's browser session. This vulnerability presents significant risk implications, potentially allowing attackers to compromise user accounts, hijack active sessions, or gain elevated access depending on the privileges of the interacting victim. Successful exploitation requires specific conditions beyond the direct control of the attacker, and the security scope is characterized as changed. The combination of persistent payload storage and client-side execution underlines the necessity for rigorous input sanitization and output encoding across all application input vectors.",
  "technicalDetails": "The vulnerability resides in the input handling mechanism of Adobe Commerce, specifically within vulnerable form fields that fail to properly sanitize, validate, or encode user-supplied input before persisting it to the underlying data store. This architectural oversight permits the storage of malicious script payloads, classifying the flaw as a stored Cross-Site Scripting (XSS) vulnerability with a changed security scope. Exploitation requires a low-privileged authenticated attacker capable of interacting with the vulnerable form fields to inject crafted JavaScript sequences. The attack flow proceeds in multiple stages: first, the malicious actor submits the payload into the susceptible form field, which subsequently processes and writes the unescaped string into the database or persistent storage without applying appropriate contextual output encoding. Second, an unsuspecting victim, who may possess higher privileges, navigates to the specific application page containing the rendered form field data. Third, the application retrieves the stored record and injects the raw payload directly into the Document Object Model (DOM) of the response sent to the victim's browser. Finally, the victim's browser parses the HTML response and executes the embedded JavaScript within the security context of the victim's active session. The execution of this malicious script can lead to severe post-exploitation impact, including unauthorized access to sensitive session cookies, DOM manipulation, actions performed on behalf of the victim, and potential escalation of privileges or complete account takeover depending on the victim's administrative standing. The exploit vector depends heavily on environmental conditions and user interaction beyond the direct control of the attacker, specifically requiring a victim to visit the poisoned page."
}