Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability that can be abused by a low‑privileged attacker to inject malicious scripts into vulnerable form fields. The injected JavaScript is executed when a victim visits a page containing the field, potentially compromising data integrity, confidentiality, and enabling phishing or further exploitation. The weakness is identified as CWE‑79.

Affected systems include Adobe Experience Manager, specifically versions 6.5.23 and earlier. No additional vendor or product variants are explicitly listed beyond the general Adobe Experience Manager family.

The CVSS score is 5.4, indicating moderate severity, and the EPSS score is <1%, suggesting low exploit probability. This vulnerability is not listed in the CISA KEV catalog. Attackers require only low privileges, such as a content author, to inject payloads into form fields. Once injected, the payload persists until removed, giving the attacker a persistent foothold for client‑side attacks.