Loading vulnerability…
Stored XSS in Adobe Commerce
CVE-2026-47995 is a stored cross-site scripting vulnerability in Adobe Commerce product lines, including Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin. A high-privileged attacker can inject malicious script content into vulnerable form fields, where the payload is stored by the application and later rendered to other users. When a victim browses to a page containing the tainted field, attacker-controlled JavaScript executes in the victim's browser within the application's security context. The vulnerability is classified as stored XSS with changed scope because exploitation can compromise another user's session or privileges through client-side code execution in that user's browser.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables execution of attacker-supplied JavaScript in the browser of a user who views the affected page. This can result in session hijacking, unauthorized actions performed as the victim, theft of sensitive data exposed to the browser, and potential privilege escalation or broader account compromise depending on the victim's role and available application functionality. Because the payload is stored server-side and delivered to subsequent viewers, the issue can affect multiple users until the malicious content is removed.
If you can’t patch tonight, do this now.
No product-specific workaround is described beyond updating to the fixed releases. Until patching is completed, reduce exposure by limiting access to administrative and high-privilege interfaces, reviewing and removing untrusted stored content from relevant form fields, enforcing least privilege for accounts that can edit affected content, and monitoring for suspicious administrative changes or unexpected script execution in application pages.
Patch, then assume compromise.
Upgrade affected products to fixed releases provided by Adobe. Unaffected versions are Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, and 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, and 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, and 2.4.6-2026-jul; and Adobe Commerce Webhooks Plugin 1.21.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.