Adobe Experience Manager is vulnerable to a stored Cross‑Site Scripting attack that allows a low‑privileged attacker to inject malicious JavaScript into form fields. When a victim accesses a page containing the tampered field, the embedded JavaScript is executed in the victim’s browser, potentially stealing session data, performing unauthorized actions, or defacing the site. The vulnerability is rated with a CVSS score of 5.4 and involves a change of scope, indicating that the impact moves beyond the originally allowed authorization level.

Affected versions are Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. No more granular version data is provided.

The CVSS score of 5.4 reflects a moderate severity level. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, it remains exploitable by attackers who can submit malicious scripts to the application. Attackers likely need only a low level of access, such as the ability to submit content via a form. The exploitation does not provide remote code execution; it operates within the victim’s browser, but the potential to compromise user credentials or deface the site makes it a concern. Due to the missing EPSS data, the actual likelihood of exploitation is uncertain, but the existence of a public advisory suggests it is a risk worth addressing promptly.