Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Severity
Medium 5.4
Published
11 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.4.4
Sources
NVD
Affected software
Software
Affected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
Version 2.4.8-beta1
Version 2.4.7-p3
Version 2.4.7-p2
Version 2.4.7-p1
All 38 release lines
Every version before 2.4.4
Version 2.4.4
Version 2.4.4-p1
Version 2.4.4-p2
Version 2.4.4-p3
Version 2.4.4-p4
Version 2.4.4-p5
Version 2.4.4-p6
Version 2.4.4-p7
Version 2.4.4-p8
Version 2.4.4-p9
Version 2.4.4-p10
Version 2.4.4-p11
Version 2.4.5
Version 2.4.5-p1
Version 2.4.5-p2
Version 2.4.5-p3
Version 2.4.5-p4
Version 2.4.5-p5
Version 2.4.5-p6
Version 2.4.5-p7
Version 2.4.5-p8
Version 2.4.5-p9
Version 2.4.5-p10
Version 2.4.6
Version 2.4.6-p1
Version 2.4.6-p2
Version 2.4.6-p3
Version 2.4.6-p4
Version 2.4.6-p5
Version 2.4.6-p6
Version 2.4.6-p7
Version 2.4.6-p8
Version 2.4.7
Version 2.4.7-p1
Version 2.4.7-p2
Version 2.4.7-p3
Version 2.4.8-beta1
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento