Stored Cross-Site Scripting Flaw in Adobe Commerce

CVE-2025-54266

What is CVE-2025-54266?

Adobe Commerce versions 2.4.9-alpha2 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) issue that allows attackers with high-level privileges to inject malicious scripts into form fields. When users interact with the affected forms, these harmful scripts may execute in their browsers, compromising user security. Exploitation of this vulnerability necessitates user interaction, as victims must navigate to the page containing the compromised fields, allowing attackers to operate within the scope of the affected application.

References