Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier allow a low‑privileged attacker to store malicious JavaScript in optional form fields. When a user later views the page that renders the stored data, the script executes in the victim’s browser, potentially allowing data theft, session hijacking, or injection of further malicious content. The vulnerability is a classic input‑validation flaw (CWE‑79) and the CVSS score of 5.4 reflects moderate exploitation potential.

The affected products are Adobe Experience Manager instances running any of the following releases: 6.5.24, the LTS SP1 branch, or any release dated 2026.04 or earlier. All deployment locations that expose these form fields to users are potentially impacted.

The CVSS score indicates moderate severity, and the EPSS score is not available, so no quantified exploitation probability exists. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely abused yet. Because the flaw is stored, an attacker does not need direct web access; simply adding malicious content to a form that a legitimate user will later view is sufficient. The scope change indicates that the impact might affect a broader set of application components than a typical single‑page XSS.