Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross‑site scripting vulnerability that allows a low‑privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim visits the page containing the injected field, the script runs in the victim’s browser, enabling potential data theft, session hijacking or defacement. The flaw is marked as changing scope, meaning the attacker may affect higher privileges than initially intended.

Adobe Experience Manager versions 6.5.24 and earlier, including the LTS SP1 and 2026.04 releases.

With a CVSS score of 5.4 the vulnerability is rated moderate in severity. EPSS data is not available, so the precise exploitation probability cannot be quantified, but the requirement for a low‑privilege attacker to provide input and the need for the victim to view the page indicate that exploitation hinges on user interaction. The flaw is not currently listed in the CISA KEV catalog. Attackers typically achieve the exploit by submitting malicious form input that is stored and later rendered without proper sanitization.