Adobe Experience Manager versions 6.5.24 and earlier contain a stored Cross‑Site Scripting vulnerability that permits a low‑privileged attacker to insert malicious JavaScript into form fields. When a victim accesses the page containing the injected content, the browser executes the script, potentially leading to client‑side compromise, credential theft, or the execution of further attacks. The weakness is a classic input validation failure (CWE‑79), and the vulnerability’s scope change indicates that the impact extends beyond the original component.

Adobe Experience Manager (Adobe) – affected releases include 6.5.24, LTS SP1, and any 2026.04 build or earlier.

The CVSS score of 5.4 classifies the issue as moderate, and the EPSS score is not available, suggesting limited known exploitation evidence. The vulnerability is not listed in CISA’s KEV catalog. An attacker with access to the form input area can abuse this flaw, and because it involves a stored payload, the risk remains as long as the form field is rendered to users. The lack of higher privileges required makes it a low‑barrier attack vector that may be exploited in targeted or opportunistic attacks.