Adobe Commerce is impacted by a stored cross‑site scripting vulnerability, allowing a high‑privileged attacker to inject malicious scripts through vulnerable form fields. When a victim’s browser loads a page containing the injected code, the script executes in their browser context, which could result in theft of credentials, hijacking of the user’s session, or takeover of the victim’s account, especially if the victim has administrative privileges.

The affected vendors are Adobe and its products Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. No specific version information is provided in the current data, so any installation prior to the release that fixes this issue is considered vulnerable.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that active exploitation is not currently documented. However, because the flaw requires high privileges for injection and can affect all users who view the affected page, the overall risk remains significant, especially for organizations with many users who can access the vulnerable forms or where privileged accounts are compromised.