Adobe Commerce is vulnerable to a stored Cross‑Site Scripting flaw that allows an attacker to embed malicious scripts into form fields. When a victim visits a page containing the compromised field, the injected JavaScript executes in the victim’s browser, potentially enabling the attacker to hijack the victim’s session or elevate privileges. The weakness is a classic client‑side code injection (CWE‑79) and is noted as a scope‑changing vulnerability.

Affected products include Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. No specific version information is provided in the advisory.

The CVSS score of 9.3 indicates critical severity; the EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely but recent advisory timing suggests a risk of active attacks. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit this flaw by submitting crafted input through exposed form fields, which is then stored and re‑served to other users. Successful exploitation can lead to full client‑side code execution within the victim’s browser context.