A low‑privileged attacker can insert malicious JavaScript into specific form fields within Adobe Experience Manager, creating a stored Cross‑Site Scripting (XSS) flaw. When a victim visits a page that contains the injected script, the code executes in the victim’s browser, potentially allowing the attacker to hijack sessions, deface content, or exfiltrate data. The description notes that the vulnerability’s scope is changed, implying that the impact may extend beyond the affected field to other components or user interactions.

Adobe Experience Manager is affected by this flaw, specifically all releases within the FP11.4 maintenance branch and earlier. The vulnerability applies to the version identified by the CPE string although that is omitted here; the key point is that any installation on or before FP11.4 is susceptible.

The CVSS score of 5.4 places this issue in the moderate severity range, and the EPSS score of < 1% indicates a low probability of exploitation in the near term. It is not listed in CISA’s KEV catalog. The likely attack vector is the web application, where an attacker with modest privileges submits data to vulnerable form fields that is subsequently rendered without proper sanitization. Because script execution occurs client‑side, an attacker can perform session hijacking or phishing attacks based on the user’s context.