Adobe Experience Manager is vulnerable to a stored Cross‑Site Scripting flaw that allows a low‑privileged attacker to inject malicious scripts into form fields. The payload is persisted and displayed to other users when they view the affected page, leading to arbitrary JavaScript execution in their browsers. Because the scope is changed, the vulnerability can potentially affect other parts of the application beyond the initial input surface.

The flaw impacts Adobe Experience Manager 6.5, the current version used by environments that have not applied the latest security update. No specific sub‑versions are listed, so the entire 6.5 release series should be considered at risk.

The CVSS base score of 5.4 classifies the vulnerability as moderate severity, and the EPSS score is not available, indicating no current data on exploitation frequency. It is not listed in CISA's KEV catalog, suggesting no confirmed active exploitation, yet the scope change and stored nature increase the risk of widespread damage when abused. Attackers can likely exploit the flaw by submitting crafted input through a form while having basic user access, so mitigation is advised even without immediate exploitation traces.