What is the CVSS score of CVE-2026-48371?

CVE-2026-48371 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Commerce CVE-2026-48371

EUVD-2026-44415 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 adobe

GHSA-qxhc-c8fh-mr68

XSS Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires low-privileged write access (PR:L) and victim page visit (UI:R); S:C reflects injected script executing in victim browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:41 vuln.today

CVE Published

Jul 14, 2026 - 19:44 cve.org

MEDIUM 5.4

DescriptionCVE.org

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-controlled data before it is persisted and later rendered in a browser. Unlike reflected XSS, stored XSS embeds the payload in the application's data store - a database record, CMS block, product attribute, or webhook configuration - so any subsequent visitor to the affected page triggers execution without requiring a crafted link. Adobe Commerce and its open-source sibling Magento are PHP-based e-commerce platforms with complex admin interfaces containing many user-input surfaces (product descriptions, CMS pages, custom attributes, webhook definitions). The confirmed CPE strings span four components: cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin, indicating the flaw is not isolated to one input surface. The S:C (scope change) in the CVSS vector is consistent with cross-origin JavaScript execution, where the injected script can interact with the browser environment outside the vulnerable application's own origin.

RemediationAI

Adobe has released patches for all affected products in the July 2026 security update cycle documented in APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). Adobe Commerce operators should apply the July 2026 patch corresponding to their branch: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul. Magento Open Source operators should apply 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. Adobe Commerce B2B should be updated to the applicable July 2026 release: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul. The Adobe Commerce Webhooks Plugin should be upgraded to version 1.21.0. As a compensating control prior to patching, restrict Commerce admin panel access to trusted IP ranges using network-layer controls, and audit low-privileged user role assignments to remove write access to form fields not required for job function - note this reduces the attacker pool but does not eliminate the vulnerability if any low-privileged write access remains.