CVE-2026-48414
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control, and the scope is changed.
Risk Assessment
The risk is the potential for account or session takeover, which could lead to data theft or unauthorized actions. User interaction is required (visiting the page), limiting automated attacks.
Recommendation
It is recommended to update Adobe Commerce to a patched version and implement input filtering mechanisms. Also educate users about the risks of clicking suspicious links.
Original NVD description (English source)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Scope is changed.