CVE-2025-54266: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
Other sources
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p13 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p8 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.8-p3 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.9-alpha3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54266?
CVE-2025-54266 is considered a high severity vulnerability due to its ability to allow high-privileged attackers to execute stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-54266?
To fix CVE-2025-54266, upgrade Adobe Commerce to a version that is not affected, specifically versions later than 2.4.9-alpha2.
Which versions of Adobe Commerce are affected by CVE-2025-54266?
CVE-2025-54266 affects Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, and 2.4.4-p15 and earlier.
What types of attacks can CVE-2025-54266 enable?
CVE-2025-54266 can enable stored Cross-Site Scripting (XSS) attacks, allowing attackers to inject malicious scripts.
Who is at risk due to CVE-2025-54266?
High-privileged users of Adobe Commerce are at risk due to CVE-2025-54266, as they can potentially exploit the vulnerability.