Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed…
Severity
High 8.4
Published
10 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD
Affected software
Software
Affected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
Version 2.4.8
Version 2.4.7-p5
Version 2.4.7-p4
Version 2.4.7-p3
All 48 release lines
Version 2.4.4
Version 2.4.4-p1
Version 2.4.4-p2
Version 2.4.4-p3
Version 2.4.4-p4
Version 2.4.4-p5
Version 2.4.4-p6
Version 2.4.4-p7
Version 2.4.4-p8
Version 2.4.4-p9
Version 2.4.4-p10
Version 2.4.4-p11
Version 2.4.4-p12
Version 2.4.4-p13
Version 2.4.5
Version 2.4.5-p1
Version 2.4.5-p2
Version 2.4.5-p3
Version 2.4.5-p4
Version 2.4.5-p5
Version 2.4.5-p6
Version 2.4.5-p7
Version 2.4.5-p8
Version 2.4.5-p9
Version 2.4.5-p10
Version 2.4.5-p11
Version 2.4.5-p12
Version 2.4.6
Version 2.4.6-p1
Version 2.4.6-p2
Version 2.4.6-p3
Version 2.4.6-p4
Version 2.4.6-p5
Version 2.4.6-p6
Version 2.4.6-p7
Version 2.4.6-p8
Version 2.4.6-p9
Version 2.4.6-p10
Version 2.4.7-b1
Version 2.4.7-b2
Version 2.4.7-beta3
Version 2.4.7
Version 2.4.7-p1
Version 2.4.7-p2
Version 2.4.7-p3
Version 2.4.7-p4
Version 2.4.7-p5
Version 2.4.8
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento