Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Overview

CVE-2025-24438 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The flaw resides in vulnerable form fields where a low-privileged attacker can inject malicious JavaScript that persists on the server. When an administrator or other user views the page containing the injected script, the browser executes it [1].

Exploitation

Prerequisites

An attacker must have a low-privileged account (e.g., a merchant or content contributor) to access the vulnerable form fields. No additional authentication bypass is required; the attacker simply submits crafted input that is not properly sanitized. The stored script then triggers automatically when any victim navigates to the affected page [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser session. This can be leveraged to steal session cookies, perform actions on behalf of the victim, and ultimately achieve session takeover. Adobe rates the confidentiality and integrity impact as high due to the potential for full administrative control [1].

Mitigation

Adobe has released security patches for the affected versions. Users should upgrade to the latest patched versions (2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, or later) as recommended in the official advisory. No workarounds are documented; applying the patch is the only reliable mitigation [1].