Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross‑site scripting vulnerability that allows a low‑privileged attacker to inject malicious scripts into vulnerable form fields. When a user accesses a page containing the injected script, the JavaScript executes in the victim’s browser, potentially performing undesired actions.

The affected product is Adobe Experience Manager, versions 6.5.23 and earlier, covering both on‑premise and cloud service deployments as represented by the listed CPE entries.

The CVSS score is 5.4, indicating medium severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of exploitation. Attacking requires only low‑privilege access to submit data to a vulnerable form field; the stored nature of the flaw enables repeated impact on multiple users once injected.