CVE-2026-34658: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published May 12, 2026
·Updated
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
162 affected components
Adobe Adobe Commerce<=2.4.9-beta1
Adobe Commerce<2.4.4
Adobe Commerce=2.4.4
Adobe Commerce=2.4.4-p1
Adobe Commerce=2.4.4-p10
Adobe Commerce=2.4.4-p11
Adobe Commerce=2.4.4-p12
Adobe Commerce=2.4.4-p13
Adobe Commerce=2.4.4-p14
Adobe Commerce=2.4.4-p15
Adobe Commerce=2.4.4-p16
Adobe Commerce=2.4.4-p17
Adobe Commerce=2.4.4-p2
Adobe Commerce=2.4.4-p3
Adobe Commerce=2.4.4-p4
Adobe Commerce=2.4.4-p5
Adobe Commerce=2.4.4-p6
Adobe Commerce=2.4.4-p7
Adobe Commerce=2.4.4-p8
Adobe Commerce=2.4.4-p9
Adobe Commerce=2.4.5
Adobe Commerce=2.4.5-p1
Adobe Commerce=2.4.5-p10
Adobe Commerce=2.4.5-p11
Adobe Commerce=2.4.5-p12
Adobe Commerce=2.4.5-p13
Adobe Commerce=2.4.5-p14
Adobe Commerce=2.4.5-p15
Adobe Commerce=2.4.5-p16
Adobe Commerce=2.4.5-p2
Adobe Commerce=2.4.5-p3
Adobe Commerce=2.4.5-p4
Adobe Commerce=2.4.5-p5
Adobe Commerce=2.4.5-p6
Adobe Commerce=2.4.5-p7
Adobe Commerce=2.4.5-p8
Adobe Commerce=2.4.5-p9
Adobe Commerce=2.4.6
Adobe Commerce=2.4.6-p1
Adobe Commerce=2.4.6-p10
Adobe Commerce=2.4.6-p11
Adobe Commerce=2.4.6-p12
Adobe Commerce=2.4.6-p13
Adobe Commerce=2.4.6-p14
Adobe Commerce=2.4.6-p2
Adobe Commerce=2.4.6-p3
Adobe Commerce=2.4.6-p4
Adobe Commerce=2.4.6-p5
Adobe Commerce=2.4.6-p6
Adobe Commerce=2.4.6-p7
Adobe Commerce=2.4.6-p8
Adobe Commerce=2.4.6-p9
Adobe Commerce=2.4.7
Adobe Commerce=2.4.7-b1
Adobe Commerce=2.4.7-b2
Adobe Commerce=2.4.7-beta3
Adobe Commerce=2.4.7-p1
Adobe Commerce=2.4.7-p2
Adobe Commerce=2.4.7-p3
Adobe Commerce=2.4.7-p4
Adobe Commerce=2.4.7-p5
Adobe Commerce=2.4.7-p6
Adobe Commerce=2.4.7-p7
Adobe Commerce=2.4.7-p8
Adobe Commerce=2.4.7-p9
Adobe Commerce=2.4.8
Adobe Commerce=2.4.8-beta1
Adobe Commerce=2.4.8-beta2
Adobe Commerce=2.4.8-p1
Adobe Commerce=2.4.8-p2
Adobe Commerce=2.4.8-p3
Adobe Commerce=2.4.8-p4
Adobe Commerce=2.4.9-beta1
Adobe Commerce B2b<1.3.3
Adobe Commerce B2b=1.3.3
Adobe Commerce B2b=1.3.3-p1
Adobe Commerce B2b=1.3.3-p10
Adobe Commerce B2b=1.3.3-p11
Adobe Commerce B2b=1.3.3-p12
Adobe Commerce B2b=1.3.3-p13
Adobe Commerce B2b=1.3.3-p14
Adobe Commerce B2b=1.3.3-p15
Adobe Commerce B2b=1.3.3-p16
Adobe Commerce B2b=1.3.3-p17
Adobe Commerce B2b=1.3.3-p2
Adobe Commerce B2b=1.3.3-p3
Adobe Commerce B2b=1.3.3-p4
Adobe Commerce B2b=1.3.3-p5
Adobe Commerce B2b=1.3.3-p6
Adobe Commerce B2b=1.3.3-p7
Adobe Commerce B2b=1.3.3-p8
Adobe Commerce B2b=1.3.3-p9
Adobe Commerce B2b=1.3.4
Adobe Commerce B2b=1.3.4-p1
Adobe Commerce B2b=1.3.4-p10
Adobe Commerce B2b=1.3.4-p11
Adobe Commerce B2b=1.3.4-p12
Adobe Commerce B2b=1.3.4-p13
Adobe Commerce B2b=1.3.4-p14
Adobe Commerce B2b=1.3.4-p15
Adobe Commerce B2b=1.3.4-p16
Adobe Commerce B2b=1.3.4-p2
Adobe Commerce B2b=1.3.4-p3
Adobe Commerce B2b=1.3.4-p4
Adobe Commerce B2b=1.3.4-p5
Adobe Commerce B2b=1.3.4-p6
Adobe Commerce B2b=1.3.4-p7
Adobe Commerce B2b=1.3.4-p8
Adobe Commerce B2b=1.3.4-p9
Adobe Commerce B2b=1.4.2
Adobe Commerce B2b=1.4.2-p1
Adobe Commerce B2b=1.4.2-p2
Adobe Commerce B2b=1.4.2-p3
Adobe Commerce B2b=1.4.2-p4
Adobe Commerce B2b=1.4.2-p5
Adobe Commerce B2b=1.4.2-p6
Adobe Commerce B2b=1.4.2-p7
Adobe Commerce B2b=1.4.2-p8
Adobe Commerce B2b=1.4.2-p9
Adobe Commerce B2b=1.5.2
Adobe Commerce B2b=1.5.2-p1
Adobe Commerce B2b=1.5.2-p2
Adobe Commerce B2b=1.5.2-p3
Adobe Commerce B2b=1.5.2-p4
Adobe Commerce B2b=1.5.3-beta1
Adobe Magento<2.4.6
Adobe Magento=2.4.6
Adobe Magento=2.4.6-p1
Adobe Magento=2.4.6-p10
Adobe Magento=2.4.6-p11
Adobe Magento=2.4.6-p12
Adobe Magento=2.4.6-p13
Adobe Magento=2.4.6-p14
Adobe Magento=2.4.6-p2
Adobe Magento=2.4.6-p3
Adobe Magento=2.4.6-p4
Adobe Magento=2.4.6-p5
Adobe Magento=2.4.6-p6
Adobe Magento=2.4.6-p7
Adobe Magento=2.4.6-p8
Adobe Magento=2.4.6-p9
Adobe Magento=2.4.7
Adobe Magento=2.4.7-b1
Adobe Magento=2.4.7-b2
Adobe Magento=2.4.7-beta3
Adobe Magento=2.4.7-p1
Adobe Magento=2.4.7-p2
Adobe Magento=2.4.7-p3
Adobe Magento=2.4.7-p4
Adobe Magento=2.4.7-p5
Adobe Magento=2.4.7-p6
Adobe Magento=2.4.7-p7
Adobe Magento=2.4.7-p8
Adobe Magento=2.4.7-p9
Adobe Magento=2.4.8
Adobe Magento=2.4.8-beta1
Adobe Magento=2.4.8-beta2
Adobe Magento=2.4.8-p1
Adobe Magento=2.4.8-p2
Adobe Magento=2.4.8-p3
Adobe Magento=2.4.8-p4
Adobe Magento=2.4.9-beta1
Event History
May 12, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·07:50 PM
Data Sourced
via MITRE·07:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2026-34658?
CVE-2026-34658 is classified as a high severity vulnerability due to its potential for stored Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2026-34658?
To fix CVE-2026-34658, upgrade Adobe Commerce to version 2.4.9-beta2 or later.
3
Who is affected by CVE-2026-34658?
CVE-2026-34658 affects Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, and earlier releases.
4
What kind of attack is possible with CVE-2026-34658?
CVE-2026-34658 allows high-privileged attackers to perform stored Cross-Site Scripting (XSS) attacks.
5
When was CVE-2026-34658 discovered?
CVE-2026-34658 is noted for its disclosure in 2026, highlighting vulnerabilities in specific Adobe Commerce versions.