Adobe Commerce contains a stored XSS vulnerability that could allow a low-privileged attacker to perform session takeovers through malicious script injection.

This is a stored Cross-Site Scripting (CWE-79) vulnerability occurring in form fields. The flaw requires a low-privileged authenticated attacker to inject scripts and necessitates user interaction from a victim to trigger the payload.

Successful exploitation poses a significant risk to the confidentiality and integrity of the application. By executing malicious scripts in the context of a victim session, attackers can perform unauthorized actions or hijack user accounts, including administrative sessions. Given the CVSS score of 8.7, this vulnerability is classified as High severity and requires prompt attention to prevent account compromise.

Immediate Action: Update Adobe Commerce to the latest patched versions, specifically 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, or 2.4.7-p7.

Proactive Monitoring: Monitor web application logs for unusual script tags or encoded payloads submitted through form fields.

Compensating Controls: Deploy or tune a Web Application Firewall (WAF) to detect and block common XSS patterns in form submissions.

Public Exploit Available: Unknown.

Organizations utilizing affected versions of Adobe Commerce should prioritize the application of the provided security patches. Given the potential for full session takeover, testing and deploying these updates in staging environments before moving to production is recommended to maintain system stability while closing this critical security gap.