Adobe Connect contains a stored Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into form fields. When a victim later views a page containing the infected data, the browser executes the script, potentially compromising the victim’s session or granting elevated privileges. The vulnerability’s scope is changed, indicating that the attacker could escape the restricted context of the application and affect higher‑level resources.

Affected products include Adobe Connect for web and Adobe Connect Android Mobile App. No specific product versions are listed in the advisory, so all current releases may be at risk until a patch is applied.

The CVSS score of 9.3 categorises this flaw as critical. The EPSS score is 1% and it is not listed in the CISA KEV catalogue. The stored nature of the XSS and the possibility of privilege escalation raise the likelihood that it could be exploited by attackers who can submit data to vulnerable form fields. The attack vector is likely via the web interface, requiring the victim to visit the compromised page to trigger the script.