Adobe Commerce Stored Cross-Site Scripting Vulnerability Allowing Privilege Escalation

A stored cross-site scripting vulnerability has been identified in Adobe Commerce. This issue allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim interacts with the page containing the compromised field, the injected JavaScript is executed in their browser. The vulnerability is present in several versions of Adobe Commerce and Magento Open Source.

Impact

Exploitation of this vulnerability could lead to stored cross-site scripting, allowing injected scripts to be executed in the context of the user's browser.

Remediation

Users are advised to update to the latest versions of Adobe Commerce or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB26-73.