Adobe Commerce is vulnerable to a stored Cross‑Site Scripting (XSS) flaw (CWE‑79) that allows a high‑privileged attacker to submit malicious JavaScript into form fields. When a victim visits the page containing the stored input, the script executes in the victim’s browser, potentially hijacking their session or elevating their access because the vulnerability’s scope is changed.

Affected products include Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, and Magento Open Source. No specific version numbers are listed, so administrators should verify that any installed instance of these products is potentially susceptible.

The CVSS score of 8.1 categorizes the issue as high severity, but the EPSS score is less than 1%, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker with elevated privileges to submit input to the vulnerable form and then rely on the changed scope to achieve further compromise once the script runs.