The vulnerability is a stored Cross‑Site Scripting (XSS) flaw in Adobe Experience Manager that allows a low‑privileged attacker to inject malicious JavaScript into form fields. When an unsuspecting user visits a page containing the vulnerable field, the injected script executes in the user's browser, potentially leading to theft of credentials, session hijacking, or other malicious actions. The weakness maps to CWE‑79, representing improper handling of user input that leads to script execution.

Adobe Experience Manager, in all 6.5.x releases up to and including version 6.5.23, and potentially earlier supported legacy releases. According to the known CPEs, the affected product families include the core Experience Manager application and the Adobe Experience Manager Cloud Service. Administrators should verify if their environment is running a version affected by this flaw.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need access to create or edit content within a form field that is rendered on a publicly accessible page, implying a web‑based attack vector. Given the modest severity and low exploitation probability, the risk is moderate but should be addressed promptly.