Adobe Experience Manager versions 6.5.23 and earlier are vulnerable to a stored Cross‑Site Scripting (XSS) flaw. The flaw allows an attacker to inject malicious JavaScript into form fields that are subsequently rendered to users. When a victim visits a page containing the affected field, the script executes in the victim's browser, potentially enabling credential theft, session hijacking, or defacement. The weakness is a classic input‑validation defect (CWE‑79).

The vulnerability affects Adobe Experience Manager, version 6.5.23 and all earlier releases. Affected CPEs include adobe:experience_manager:6.5:* and its change‑pack derivatives used by on‑premise and cloud services. Any deployment that uses these versions and allows unauthenticated or authenticated users to submit and store content in the web interface is susceptible.

The CVSS score is 5.4, indicating moderate severity, and the EPSS probability is below 1%, suggesting low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit it by submitting crafted input through vulnerable form fields, a web‑based attack vector that requires remote access to the content authoring interface. Patching remains the most reliable mitigation.