Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability that allows a low‑privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. The weakness is identified as CWE‑79 and poses a threat of script execution within the victim’s session.

The affected product is Adobe Experience Manager, specifically versions 6.5.23 and all earlier releases, including the 6.5 sp1 variant.

This vulnerability carries a CVSS score of 5.4 and an EPSS score of less than 1 %. The information available indicates that exploitation requires a low‑privileged attacker to submit malicious input that is stored, and the execution occurs when a user visits the page containing that stored input. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.