A stored cross‑site scripting flaw allows a low‑privileged user to inject malicious JavaScript into form fields that are rendered in the victim’s browser. The input is saved and later displayed without proper output encoding, enabling script execution that can lead to information theft, session hijacking, or defacement. The weakness is identified as input validation and output encoding failure, categorized as CWE‑79.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and all earlier releases are affected. The vulnerability resides in the form handling component that accepts input from users with low privileges.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, implying limited widespread exploitation reports. The likely attack vector is a trusted form submission page where a low‑privileged attacker can supply malicious input; if the application fails to sanitize and encode that input, the JavaScript will execute when the page is viewed by another user. The scope change suggests that the impact could extend beyond a single resource, potentially affecting the entire application context.