Adobe Commerce is vulnerable to a stored Cross‑Site Scripting flaw that allows an attacker with low level privileges to inject malicious JavaScript into form fields. When a victim visits the page containing that field, the script runs in their browser and can potentially elevate the attacker’s privileges or hijack the victim’s account or session. The flaw is a classic CWE‑79 situation and modifies the scope of the affected system.

Adobe Commerce, Adobe Commerce B2B and Magento Open Source are listed as affected. No version specifics are published in the data, so any deployment of these products could be impacted unless more recent fixed releases are already in use.

The CVSS score of 8.7 reflects a high severity. EPSS data is unavailable and the vulnerability is not cataloged in CISA KEV. Likely attack vector is via the web application; an attacker must insert payloads into user‑submitted forms accessible with ordinary credentials, then wait for a victim to view the contaminated page. Because the payload is stored, it will affect all users who load the page, making exploitation easier if the content is widely viewed.