EUVD-2026-44413
GHSA-43w8-p43r-wq5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Commerce/Magento account
-
DeliveryInject JavaScript into vulnerable form field
-
ExploitPayload stored server-side
-
ExecutionAdmin browses page rendering field
-
PersistScript executes in admin session
-
ImpactSession hijack and account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the Adobe Commerce/Magento instance (CVSS PR:L) with the ability to write into one of the vulnerable form fields, plus victim user interaction (UI:R): a higher-privileged user must subsequently browse to the page that renders the stored value for the payload to fire. The changed scope (S:C) means the injected value must be persisted somewhere it is later displayed within a different, higher-privileged session. Limiting factors that reduce realistic risk: the attacker cannot succeed unauthenticated, cannot force execution without the victim visiting the affected page, and meaningful escalation depends on that victim being a privileged user such as a store administrator. |
| Impact | The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N scores 8.7 (High): network-reachable and low-complexity, but gated by a low-privileged account (PR:L) and victim interaction (UI:R), with high confidentiality and integrity impact and a scope change reflecting compromise of a higher-privileged user such as a store administrator. No EPSS score was supplied in the input and the CVE is not in CISA KEV, so there is no public exploit identified at time of analysis and no confirmed active exploitation - do not treat POC/exploitation as present. The PR:L and UI:R constraints genuinely lower real-world exploitability versus an unauthenticated zero-click bug, so this is a real but not drop-everything issue; prioritize it for internet-facing, multi-admin, or B2B Commerce/Magento deployments where a low-privileged user can seed a page that an administrator later views. |
| Exploit ScenarioDerived | A low-privileged user - for example a limited back-office operator or a B2B company account holder - submits a form field carrying a crafted JavaScript payload that the application stores. When a higher-privileged administrator later opens the page that renders that field, the script executes in the admin's browser and steals the session or performs actions as the admin. No public proof-of-concept is referenced, and success depends on the victim actually viewing the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authenticated attacker persist malicious JavaScript into vulnerable form fields, which then executes in a victim's browser and can escalate to account or session takeover. Because scope is changed (S:C), the injected script runs in a security context beyond the attacker's own privileges - the hallmark of admin-panel or storefront XSS crossing a trust boundary. No public exploit identified at time of analysis, but the 8.7 CVSS and account-takeover impact make this a meaningful priority for e-commerce operators running the affected platforms.
RemediationAI
Apply the security update described in Adobe bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html) - Patch available per vendor advisory; the exact fixed versions for Adobe Commerce, Commerce B2B, Magento Open Source, and the Webhooks Plugin are enumerated there and should be applied through your deployment channel rather than an invented version number. Where immediate patching is not possible, apply specific compensating controls: tighten and audit which low-privileged accounts can submit the affected form fields (trade-off: operational friction), deploy a strict Content-Security-Policy to block inline script execution in the admin and storefront (trade-off: may break legitimate inline scripts and needs tuning), and front the admin panel with IP allowlisting or a WAF carrying XSS rules on the affected parameters (trade-off: possible false positives on legitimate rich content). Additionally, audit existing stored field values for previously injected markup both before and after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored/persistent form, where user-supplied data written into form fields is later rendered without adequate contextual output encoding or sanitization. Affected products per the CPE data are cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, and adobe_commerce_webhooks_plugin - all part of Adobe's Magento-derived PHP stack using PHTML/Knockout.js templating, which exposes many back-office and B2B form fields that feed admin- and customer-facing pages. Insufficient escaping in one such rendering path lets attacker-controlled markup be stored and replayed, and the changed scope indicates the payload fires in a different (higher-privileged) session than the account that injected it.
Know when Adobe Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable form field with low complexity, requiring a low-privileged account (PR:L) and victim interaction (UI:R); stored XSS crosses into a higher-privileged session (S:C) enabling session and account compromise (C:H/I:H) with no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Executive ViewAI
Attackers with low-privilege access to Adobe Commerce and Magento platforms can inject malicious code that hijacks customer and administrative accounts, exposing transaction data and operational continuity. For e-commerce businesses, this creates direct liability for customer data exposure, regulatory fines, and brand damage-particularly critical given the widespread deployment of these platforms.
No vendor-released patch identified at time of analysis. Deploy web application firewall (WAF) with rules to detect and block stored XSS payloads in form submissions. Implement strict input validation and output encoding on all user-editable form fields. Enforce restrictive Content-Security-Policy and X-XSS-Protection headers to limit malicious script execution scope. Apply role-based access controls to restrict low-privilege user permissions on sensitive form fields. Enable continuous monitoring and alerting for suspicious JavaScript execution patterns and unauthorized account access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Adobe Commerce
View allArbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plu
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plug
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improp
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to p
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plu
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an authenticated
Exploit-DB