Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Exploitation requires user interaction, as a victim must visit the page containing the vulnerable field.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-21291 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and must craft a malicious script that is injected into a vulnerable form field. The attacker then needs to trick a victim into visiting the page where the vulnerable field is located, which will execute the malicious script in the context of the victim’s session.
Affected Products
- Adobe Commerce versions 2.4.9-alpha3 and earlier
- Adobe Commerce versions 2.4.8-p3 and earlier
- Adobe Commerce versions 2.4.7-p8 and earlier
- Adobe Commerce versions 2.4.6-p13 and earlier
- Adobe Commerce versions 2.4.5-p15 and earlier
- Adobe Commerce versions 2.4.4-p16 and earlier
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Commerce that addresses this issue. Additionally, implementing input validation and sanitization on form fields can help prevent the injection of malicious scripts.