Adobe Experience Manager versions 6.5.23 and earlier are vulnerable to a stored cross‑site scripting (XSS) flaw. An attacker may inject malicious JavaScript into vulnerable form fields, and the script is executed in the victim’s browser when the page is viewed. This type of vulnerability is classified as CWE‑79 and represents an input validation weakness that can lead to arbitrary code execution.

The affected products are all Adobe Experience Manager 6.5 releases that are 6.5.23 or earlier, including the 6.5 LTS editions and the cloud service variant. The CPE entries show impact on cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:* and its SP1 variant, as well as generic Experience Manager and cloud service identifiers. No other products are listed.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to submit content containing a script to a vulnerable form field; the stored script is then executed for any user who views the page. The attack vector is likely web‑based, requiring the attacker to manipulate content submitted to the system.