Stored Cross-Site Scripting Vulnerability in Adobe Commerce

CVE-2026-48413

What is CVE-2026-48413?

Adobe Commerce is susceptible to a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious JavaScript into vulnerable form fields. When victims interact with the compromised form, the malicious code can execute in their browsers, potentially enabling attackers to gain unauthorized access to the victim's account or session. This vulnerability poses significant risks as it allows for elevated privileges through exploitation of regular user interactions.

References