Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored Cross‑Site Scripting vulnerability that allows a low‑privileged attacker to inject malicious JavaScript into form fields. The injected script executes in the victim’s browser when the page containing the vulnerable field is viewed. Scope is changed.

The affected product is Adobe Experience Manager from Adobe. Versions 6.5.24, LTS SP1, and 2026.04 and any earlier releases are prone to this vulnerability.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a low‑privileged attacker to obtain access to the CMS’s form input, likely through authenticated or public web interfaces, and submit malicious content that is stored and later rendered to users. This moderate risk, combined with the affected scope, warrants timely remediation. The likely attack vector is via the web application interface, either by a compromised user or a publicly accessible form that accepts user input.