CVE-2026-92911: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to Adobe Commerce and must be able to submit malicious content into a vulnerable form field. Exploitation also requires a victim to browse to a page that displays the stored payload.
What is the likely impact on a victim?
The injected JavaScript can run in the victim's browser and may allow the attacker to gain elevated access to, or control over, the victim's account or session. The vulnerability has changed scope, meaning the impact can extend beyond the attacker's original authorization context.