Adobe Experience Manager is affected by a stored Cross‑Site Scripting vulnerability. An attacker with low privileges can inject malicious JavaScript into vulnerable form fields. When a victim navigates to a page containing that field, the script executes in the victim’s browser, potentially exposing sensitive data or resetting session state.

Affected products include Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. No specific sub‑versions are listed beyond these product editions.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available and the issue is not yet in the CISA KEV catalog. The vulnerability is exploitable by an attacker who can submit content to vulnerable form fields; no elevated privileges or network access beyond the application is required. Given the stored nature of the payload, any subsequent user who views the content will have the malicious script executed in their browser.