The vulnerability is a stored XSS in Adobe Experience Manager 6.5.23 and earlier, allowing a low‑privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered to other users. When affected users view the page, the malicious script runs in their browser, compromising their session or data. This CWE‑79 weakness permits execution of code in the victim's context but does not provide direct system compromise.

Affected products are Adobe Experience Manager, version 6.5.23 and all earlier releases. The vulnerability impacts the specified product across both on‑premises and cloud deployments as indicated by the cpe entries.

The CVSS score of 5.4 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to create or edit a form field with malicious JavaScript; no special privileges beyond a low‑privileged user are needed. The attack vector is user‑generated content displayed to other users, making it a potential threat to any staff or customers interacting with the affected forms.