Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Overview

CVE-2025-24416 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. The flaw exists in vulnerable form fields where user-supplied input is not properly sanitized before storage, allowing an attacker to inject arbitrary JavaScript [1].

Exploitation

Prerequisites

A low-privileged attacker with basic access to the application can submit crafted payloads into these form fields. When an administrator or other victim subsequently browses to the page containing the stored payload, the malicious script executes in the context of their browser session [1]. This attack vector does not require network-level access or authentication bypass, relying instead on insufficient output encoding on the server side.

Impact

Successful exploitation enables JavaScript execution that can be used to hijack active user sessions. According to the advisory, this leads to high confidentiality and integrity impact as the attacker can impersonate the victim and perform unauthorized actions, including data exfiltration or privilege escalation within the Adobe Commerce backend [1].

Mitigation

Status

Adobe has addressed this vulnerability in security updates released with the February 2025 patch bundle. Users are strongly advised to upgrade to the latest patched versions or apply the official hotfixes as outlined in Adobe's security bulletin. No workarounds are publicly documented; the canonical repository for Magento Open Source is available for reference [2].