A stored Cross‑Site Scripting vulnerability in Adobe Commerce allows an attacker with low privileges to inject malicious JavaScript into form fields. The injected script executes in the victim’s browser when the page containing the field is viewed, enabling the attacker to gain elevated access or take control over the victim’s account or session. The vulnerability is rated as a high severity flaw due to the potential impact on confidentiality, integrity, and availability on a client‑side basis.

Adobe Commerce (formerly Magento) versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are affected. System administrators should review which exact releases are in use to determine if they fall within the affected set.

The CVSS score of 8.7 classifies this as a high‑severity risk. The EPSS score is not available, but the lack of listing in the CISA KEV catalog indicates no known large‑scale exploitation yet. Attackers can exploit this by submitting malicious content to any writable form field, after which any user who accesses the page will run the script. The scope change means that an attacker can compromise a user’s session beyond the original attacker’s own privileges, increasing the damage potential.