Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the vulnerable field, malicious JavaScript may be executed in their browser, leading to session takeover.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2026-21284 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and must craft a malicious script that is injected into a vulnerable form field. The attacker then needs to trick a victim into visiting the page containing the vulnerable field, which will execute the malicious script in the victim’s browser. This requires user interaction, making it essential for the attacker to lure the victim to the affected page.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by stored XSS vulnerability.
- Adobe Commerce 2.4.8-p3: Vulnerable to script injection attacks.
- Adobe Commerce 2.4.7-p8: Exposed to high-privileged attacker exploitation.
- Adobe Commerce 2.4.6-p13: Contains vulnerabilities allowing session takeover.
- Adobe Commerce 2.4.5-p15: Susceptible to malicious script execution.
- Adobe Commerce 2.4.4-p16: Earlier versions are also affected.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, implementing input validation and sanitization for user inputs can help prevent script injection. Regular security audits and user training on recognizing phishing attempts can also reduce the risk of exploitation.