A stored cross-site scripting vulnerability has been identified in Adobe Commerce. This issue allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim interacts with the page containing the compromised field, the injected JavaScript could execute in their browser, potentially leading to unauthorized access or control over the victim's account or session. The vulnerability is present in several versions of Adobe Commerce and Magento Open Source.
Exploitation of this vulnerability could result in stored cross-site scripting, allowing injected scripts to be executed in the context of the user's browser.
Users are advised to update to the latest versions of Adobe Commerce or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB26-73.
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.
