Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability that can be abused by a low‑privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses a page containing the injected script, the malicious JavaScript is executed in the victim’s browser, allowing the attacker to steal credentials, hijack sessions or deliver additional malware.

Affected systems are Adobe Experience Manager products, specifically the 6.5.23 release and all earlier 6.5 versions. The vulnerability applies to the on‑premises and cloud services as reflected in the applicable CPE namespace entries.

The CVSS score is 5.4, indicating a moderate impact. EPSS is below 1% and the vulnerability is not recorded in the CISA KEV catalog, suggesting a low probability of widespread exploitation. Attackers require only low‑privileged write access to form fields; no elevated privileges or network‑level access are needed. Once the script is stored, it will run in the browser context of any user viewing the page, making the attack vector a stored XSS leading to client‑side compromise.