Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. A high-privileged attacker could inject malicious scripts into vulnerable form fields. This could lead to the execution of malicious JavaScript in a victim’s browser when they access the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-34655 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can inject malicious scripts into form fields that are not properly sanitized. When a victim accesses the page containing the vulnerable field, the injected JavaScript executes in their browser, potentially leading to unauthorized actions or data theft.
Affected Products
- Adobe Commerce 2.4.9-beta1: Affected by XSS vulnerability allowing script injection.
- Adobe Commerce 2.4.8-p4: Vulnerable to stored XSS through form fields.
- Adobe Commerce 2.4.7-p9: Contains a flaw that can be exploited for script execution.
- Adobe Commerce 2.4.6-p14: Susceptible to high-privileged attacks via XSS.
- Adobe Commerce 2.4.5-p16: Vulnerable to malicious script injection.
- Adobe Commerce 2.4.4-p17: Affected by stored XSS vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, ensure that all form fields are properly sanitized and validated to prevent script injection.