CVE-2026-91013: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published Oct 13, 2026
·Updated
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
1 affected component
Adobe Commerce
Event History
Oct 13, 2026
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need an authenticated Adobe Commerce account to exploit this issue?
No. The vulnerability is rated with no privileges required, so exploitation does not require the attacker to be authenticated.
2
What must happen for the injected script to run?
A victim must browse to a page containing the vulnerable form field where the malicious script was stored. This requires user interaction.