Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the vulnerable field, malicious JavaScript may execute in their browser, potentially gaining elevated access or control over their account or session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-34686 |
Exploitation
To exploit this vulnerability, an attacker must identify a vulnerable form field within the affected versions of Adobe Commerce. By injecting malicious JavaScript into this field, the attacker can trick a victim into visiting the page containing the vulnerable field. Once the victim interacts with the page, the injected script executes in their browser, allowing the attacker to gain unauthorized access to the victim’s account or session.
Affected Products
- Adobe Commerce 2.4.9-beta1
- Adobe Commerce 2.4.8-p4
- Adobe Commerce 2.4.7-p9
- Adobe Commerce 2.4.6-p14
- Adobe Commerce 2.4.5-p16
- Adobe Commerce 2.4.4-p17 and earlier
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Adobe Commerce that addresses the XSS vulnerability. Additionally, implementing input validation and sanitization measures can help prevent the injection of malicious scripts into form fields.