A stored Cross‑Site Scripting vulnerability exists in Adobe Experience Manager Forms JEE, allowing an attacker to place malicious JavaScript in form fields. When a victim visits the page hosting the compromised field, the injected script runs in the victim's browser, potentially stealing credentials or hijacking a session. The flaw is classified as CWE‑79 and changes the security scope of the affected system.

Adobe Experience Manager Forms JEE LTS SP1 and all releases up to and including 6.5.24.0 are affected. Users of these product versions must verify the installed version or apply the vendor update.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw by submitting crafted form data that is stored and later rendered in a victim’s browser. This attack path is most likely remote, relying on web access to the form interface, and requires the ability to supply input that the application fails to sanitize. Because the vulnerability alters scope, successful exploitation could provide elevated privileges within the affected application.