Adobe Commerce is vulnerable to a stored Cross‑Site Scripting flaw that can be exploited by a high‑privileged attacker to inject arbitrary JavaScript into form fields. When the victim visits the affected page, the injected scripts run within the victim’s browser, potentially compromising confidential data or performing actions on their behalf. The flaw is classified as CWE‑79 and raises the risk of confidentiality, integrity, and availability impact for affected users.

The vulnerability affects Adobe Commerce versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases. The impacted product is Adobe Commerce from Adobe.

The CVSS score of 4.8 indicates a moderate severity, and the exploitability score is not available, which does not preclude actual exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need high‑privileged credentials to achieve injection, suggesting an internal threat model or privileged user must be compromised. The scope change implies a potential privilege escalation or broader impact once the attacker gains the necessary access.