Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the vulnerable field, malicious JavaScript may be executed in their browser, leading to session takeover.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8 | CVE-2026-21311 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and must craft a malicious script that is injected into a vulnerable form field. The attacker then needs to trick a victim into visiting the page containing the vulnerable field, which will execute the malicious script in the victim’s browser. This requires user interaction, making it essential for the attacker to lure the victim to the affected page.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by XSS vulnerability allowing script injection.
- Adobe Commerce 2.4.8-p3: Vulnerable to stored XSS attacks through form fields.
- Adobe Commerce 2.4.7-p8: Contains a flaw that can be exploited for session takeover.
- Adobe Commerce 2.4.6-p13: Susceptible to high-privileged attacker exploitation.
- Adobe Commerce 2.4.5-p15: Vulnerable to malicious script execution.
- Adobe Commerce 2.4.4-p16: Affected by stored XSS vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, implementing input validation and sanitization for user inputs can help prevent script injection. Regular security audits and user training on recognizing phishing attempts can also reduce the risk of exploitation.