Adobe Experience Manager suffers from a stored cross‑site scripting flaw. A low‑privileged user can inject malicious JavaScript into user‑supplied form fields. When another user later views the page containing that stored payload, the script runs in the victim’s browser. The injected code can alter the page, exfiltrate data from the browser, or perform actions on the visitor’s behalf. The vulnerability is a classic input‑validation issue identified as CWE‑79.

Adobe Experience Manager 6.5 and the long‑term support release 6.5 LTS. All builds of these major releases are affected; no specific patch version is listed in the advisory. The flaw impacts the web application components that render and store user‑supplied form data.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, so the current exploitation probability cannot be assessed. The vulnerability is not listed in the CISA KEV catalog. The exploit can be performed by any user who can submit or edit content in the affected form fields, meaning privileged credentials are not required. Once a victim loads the compromised page, the stored script executes in their browser, affecting confidentiality and integrity of the victim’s session.