Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the vulnerable field, malicious JavaScript may execute in their browsers, leading to session takeover and high confidentiality and integrity impacts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-21290 |
Exploitation
To exploit this vulnerability, an attacker must first identify a vulnerable form field within the affected versions of Adobe Commerce. The attacker then crafts a malicious script and injects it into the vulnerable field. Once the victim interacts with the page containing the malicious script, it executes in their browser, allowing the attacker to potentially take over the victim’s session.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by XSS vulnerability allowing script injection.
- Adobe Commerce 2.4.8-p3: Vulnerable to stored XSS attacks through form fields.
- Adobe Commerce 2.4.7-p8: Contains vulnerabilities that can be exploited for session takeover.
- Adobe Commerce 2.4.6-p13: Exposed to malicious script injection risks.
- Adobe Commerce 2.4.5-p15: Vulnerable to XSS attacks that require user interaction.
- Adobe Commerce 2.4.4-p16: Affected by stored XSS vulnerabilities.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, implementing input validation and sanitization for form fields can help prevent script injection. Regular security audits and user training on safe browsing practices are also recommended.