Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross‑Site Scripting (XSS) vulnerability that allows an attacker to store malicious JavaScript in form fields. When a victim accesses the page containing the altered field, the injected script is executed in the victim’s browser. This client‑side execution is a classic example of CWE‑79, allowing potential attacks such as phishing, session hijacking, or defacement, depending on the attacker’s goals.

The affected product is Adobe Experience Manager. All instances deployed with version 6.5.23 or earlier are vulnerable, as indicated by the CNA‑reported affected versions and the corresponding CPE entries for 6.5, LTS and SP1 releases.

The CVSS score of 5.4 classifies the issue as moderate severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting malicious script payloads via normal user input into vulnerable form fields; the execution occurs when any user views the affected page, implying a remote attack vector that requires write access to the target environment. The required preconditions and discovery level are consistent with a typical stored XSS scenario.