Adobe Commerce versions 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and all earlier releases contain a stored XSS vulnerability that an attacker with high privileges can exploit by injecting malicious JavaScript into form fields that are not properly sanitized. The malicious script is delivered to a victim’s browser when the vulnerable page is visited and can result in session hijacking, thereby raising confidentiality and integrity impact to high.

The affected software is Adobe Commerce (Magento) for all releases up to and including 2.4.9‑alpha3 and earlier. The affected versions are 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and all prior releases that are covered by the vendor’s product family.

The vulnerability has a CVSS score of 8.0, an EPSS score of less than 1%, and is not listed in CISA’s KEV catalog. Exploitation requires a privileged attacker who can submit payloads to form fields and a victim who subsequently visits the affected page. The attack vector is web‑based and would be successful if the attacker can convince a user to navigate to a page containing the malicious field.