Adobe Experience Manager is vulnerable to a stored XSS flaw that allows a low‑privileged attacker to inject malicious JavaScript into form fields. The injected code persists in the system and executes whenever a victim opens a page that displays the vulnerable field, enabling theft of session data, credential tampering, or delivery of malware. The likely attack vector is via the web form interface; based on the description, it is inferred that the attacker can submit crafted input through a vulnerable form field. Because the payload is stored, subsequent users who view the content are also exposed to the malicious script.

Adobe Experience Manager 6.5, 6.5 LTS, and Adobe Experience Manager as a Cloud Service are all impacted. Specific version ranges are not specified, so all editions of 6.5 and the cloud offering should be treated as potentially vulnerable.

The CVSS score of 5.4 categorises this as a moderate‑severity issue. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the exploitation probability is unclear, yet a stored XSS can be leveraged to steal credentials or inject additional malicious payloads. The reported scope change indicates that the flaw may also affect authentication scope or other downstream systems, raising the potential impact. Attackers can compromise the victim’s browser session, making timely remediation advisable.