Stored XSS in Adobe Commerce

Successful exploitation enables execution of attacker-supplied JavaScript in the browser context of a victim viewing the affected page. This can lead to session takeover, theft of sensitive session data, unauthorized actions performed as the victim, and compromise of confidentiality and integrity. Available scoring context indicates high confidentiality and integrity impact, with limited availability impact.

If immediate patching is not possible, restrict and closely monitor low-privileged users who can submit content into affected form fields, especially administrative or semi-trusted content contributors. Apply strict server-side input validation where feasible and ensure context-appropriate output encoding or sanitization for any stored user-supplied content rendered in HTML pages. Review customizations and third-party extensions for unsafe rendering paths, and deploy compensating controls such as WAF protections to detect or block common XSS payloads targeting relevant application inputs. Session hardening measures such as short session lifetimes and additional administrative re-authentication can reduce follow-on impact but do not eliminate the vulnerability.

Upgrade Adobe Commerce or Magento Open Source to a fixed release in the relevant supported branch. Reported fixed versions include Adobe Commerce and Magento Open Source 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, and 2.4.4-p12 or later, as applicable. Apply the vendor security update across all affected environments, including staging and production, and validate that any custom themes, modules, or form-handling extensions do not reintroduce unsafe rendering of stored input.