Adobe Commerce Stored Cross-Site Scripting Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim accesses the page containing the compromised field, the injected JavaScript is executed in their browser. This exploitation could lead to session takeover, significantly increasing risks to confidentiality and integrity.

Impact

Exploitation of this vulnerability allows for stored Cross-Site Scripting, with potential for session takeover, according to Adobe.