Adobe Commerce CVE-2025-54266

Exploitation requires an authenticated attacker with HIGH privileges (PR:H) - effectively an admin or equivalently privileged back-office account capable of writing to the affected form fields - to store the malicious script. The payload only fires when a victim user actively browses to the page that renders the vulnerable field (UI:R, confirmed in the description: 'a victim must browse to the page containing the vulnerable field'). Limiting factors: the attacker must already hold a high-privilege account (no privilege escalation from anonymous access), and no exploitation occurs without the victim navigating to the affected page. This is not remotely exploitable against default configurations by unauthenticated actors.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 4.8 (Medium), and the vector tells a coherent story: while the attack vector is network (AV:N), exploitation requires high privileges (PR:H) and victim user interaction (UI:R), which sharply limits real-world risk. The high-privilege requirement is the key constraint - an attacker must already have an authenticated admin/high-privilege account on the Commerce instance to inject the stored payload. EPSS reinforces this low urgency at 0.27% (18th percentile), indicating a low probability of exploitation in the wild. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The scope-changed flag (S:C) and the fact that injected JavaScript runs in a victim's browser (typically another admin/user session) is why Adobe rated confidentiality and integrity impact as Low rather than None, but availability is unaffected (A:N). No SSVC decision data was provided in the input. Bottom line: a legitimately Medium-severity stored XSS whose exploitation is gated behind existing high privileges and user interaction - real but not a drop-everything priority; patch during normal cycles. No signals are missing or contradictory relative to the vendor rating.

A malicious or compromised high-privileged Adobe Commerce back-office user injects a crafted JavaScript payload into a vulnerable form field. When another administrator or user later browses to the page rendering that field, the stored script executes in their browser, potentially hijacking their authenticated session or performing actions in their context. No public exploit code was identified at the time of analysis.