A stored Cross‑Site Scripting (XSS) flaw exists in Adobe Commerce that allows a high‑privileged attacker to inject malicious JavaScript into vulnerable form fields. When a user accesses a page containing the injected content, the script can execute in the victim’s browser. The vulnerability’s scope has been changed, meaning an attacker can potentially affect all higher‑privileged users when compromise occurs. The impact primarily concerns confidentiality and integrity of user sessions and may enable further exploitation beyond the original privilege level.

The affected software is Adobe Commerce from Adobe. Versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are vulnerable.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the attack vector is high‑privileged and the scope has changed, a successful exploitation can elevate the attacker’s privileges and enable them to run arbitrary code within a user’s browser. No publicly disclosed exploit is known, but the typical attack path requires the attacker to possess sufficient privileges to insert malicious data into the affected form fields.