Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. A high-privileged attacker could inject malicious scripts into vulnerable form fields. This could lead to the execution of malicious JavaScript in a victim’s browser when they visit the affected page. Exploitation requires user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-54266 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and must craft a malicious script that is injected into a vulnerable form field. The attacker then needs to trick a victim into visiting the page containing the vulnerable field, which will execute the malicious JavaScript in the victim’s browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- Adobe Commerce 2.4.9-alpha2: Affected by XSS vulnerability allowing script injection.
- Adobe Commerce 2.4.8-p2: Vulnerable to stored XSS through form fields.
- Adobe Commerce 2.4.7-p7: Contains a security flaw that can be exploited by high-privileged users.
- Adobe Commerce 2.4.6-p12: Exposed to potential XSS attacks via user interaction.
- Adobe Commerce 2.4.5-p14: Vulnerable to malicious script execution.
- Adobe Commerce 2.4.4-p15: Affected by stored XSS vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, implementing input validation and sanitization for form fields can help prevent script injection. Regular security audits and user training on recognizing phishing attempts can also reduce the risk of exploitation.