Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross‑Site Scripting (XSS) vulnerability that allows a low‑privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim visits a page that contains the injected script, the script is executed in the victim’s browser, creating an opportunity for the attacker to manipulate page content, steal session data, or perform other client‑side actions.

Affected systems are Adobe Experience Manager (vendor Adobe) version 6.5.23 and earlier. This includes the 6.5 LTS and 6.5 SP1 distributions, as well as the Adobe Experience Manager Cloud Service that incorporates these versions.

The CVSS score of 5.4 indicates medium severity, while the EPSS score of <1% suggests a low likelihood of widespread exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by submitting data to a susceptible form field that the system stores and later renders without proper sanitization, leading to execution of arbitrary scripts within the victim’s browser.