Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. A high-privileged attacker could inject malicious scripts into vulnerable form fields. This could lead to the execution of malicious JavaScript in a victim’s browser when they access the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-34658 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can inject malicious scripts into form fields that are not properly sanitized. When a victim accesses the page containing the vulnerable field, the injected JavaScript executes in their browser, potentially leading to unauthorized actions or data theft.
Affected Products
- Adobe Commerce 2.4.9-beta1: Affected by XSS vulnerability allowing script injection.
- Adobe Commerce 2.4.8-p4: Vulnerable to stored XSS attacks through form fields.
- Adobe Commerce 2.4.7-p9: Contains the same XSS vulnerability as earlier versions.
- Adobe Commerce 2.4.6-p14: Susceptible to exploitation via malicious script injection.
- Adobe Commerce 2.4.5-p16: Affected by stored XSS vulnerability.
- Adobe Commerce 2.4.4-p17: Vulnerable to high-privileged attacker exploitation.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, ensure that all form fields are properly sanitized to prevent script injection. Regular security audits and user privilege management can also help reduce the risk of exploitation.