Adobe Experience Manager is vulnerable to a stored cross‑site scripting flaw that lets a low‑privileged attacker inject malicious JavaScript into vulnerable form fields. When a victim visits a page containing the affected field, the attacker’s script runs in the victim’s browser, potentially stealing data or performing unauthorized actions on the victim’s behalf. The CVE notes a scope change, meaning the vulnerability can affect more than just the attacker’s own session.

The affected products are Adobe Experience Manager 6.5 and its 6.5 LTS edition. Only the versions listed above contain the vulnerable form‑field handling logic; newer or custom builds that include Adobe’s latest security updates are not impacted.

The CVSS score of 5.4 represents moderate severity. The EPSS score is not available, but the absence of an entry in CISA’s KEV catalog suggests it has not yet been exploited in the wild. The low‑privilege attacker requirement limits the attack surface, yet the ability to execute arbitrary script in victims’ browsers means that the vulnerability presents a tangible risk to confidentiality and integrity.