Adobe Experience Manager is vulnerable to a stored cross‑site scripting flaw that lets a low‑privileged attacker inject malicious scripts into form fields. The malicious JavaScript executes in a victim’s browser when the affected page is viewed, potentially enabling session theft, data exfiltration, or other client‑side attacks. The vulnerability’s scope is changed, meaning it could affect a wider range of users than originally anticipated.

The affected product is Adobe Experience Manager. Versions 6.5.24, the LTS SP1 release, and the 2026.04 build, along with any earlier releases of the same major version, are impacted.

The CVSS score of 5.4 indicates moderate severity. With no EPSS data available and no listing in the CISA KEV catalog, the likelihood of exploitation remains uncertain, but the fact that a low‑privileged attacker can abuse the flaw raises concerns. The changed scope increases the potential impact across the system. Attackers could exploit the stored XSS by submitting crafted input through a form and later obtain the malicious payload when any user accesses the page.