TopVuln

Details

CVSS v3

8.1

NVD published

2026-03-11 03:15:53

EPSS

0.1% probability · 27.7th percentile — 2026-03-20

Affected versions

cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p14:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p15:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p16:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p14:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p15:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:*

Summary

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

Remediation

Not available in our cache.

Exploit info

Not available in our cache.