Stored Cross-Site Scripting Flaw in Adobe Commerce
CVE-2025-54266
4.8MEDIUM
What is CVE-2025-54266?
Adobe Commerce versions 2.4.9-alpha2 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) issue that allows attackers with high-level privileges to inject malicious scripts into form fields. When users interact with the affected forms, these harmful scripts may execute in their browsers, compromising user security. Exploitation of this vulnerability necessitates user interaction, as victims must navigate to the page containing the compromised fields, allowing attackers to operate within the scope of the affected application.
Affected Version(s)
Adobe Commerce 0 <= 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
References
CVSS V3.1
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved