CVE-2025-47110: Magneto contains stored XSS vulnerability
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed to that of other high-privileged accounts, leading to a high impact on confidentiality, integrity, and availability.
Other sources
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
— GitHub
Magneto contains stored XSS vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p11 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p13 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p6 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.8-p1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47110?
CVE-2025-47110 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2025-47110?
To fix CVE-2025-47110, upgrade Adobe Commerce to versions 2.4.5-p13, 2.4.6-p11, 2.4.7-p6, or 2.4.8-p1 as applicable.
Which versions of Adobe Commerce are affected by CVE-2025-47110?
Adobe Commerce versions 2.4.4-p13 and earlier up to 2.4.8 are affected by CVE-2025-47110.
What can attackers achieve through CVE-2025-47110?
Attackers with high privileges can inject malicious scripts into vulnerable form fields due to CVE-2025-47110.
Is CVE-2025-47110 a critical issue?
Yes, CVE-2025-47110 poses a critical risk as it allows attackers to execute malicious scripts in the context of the affected application.