CVE-2026-92922: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a high-privileged attacker who can inject malicious script into vulnerable form fields. A victim must then browse to a page containing the stored payload.
Is user interaction required for exploitation?
Yes. The malicious JavaScript executes when a victim visits the page that contains the vulnerable field and stored script.
What is the likely impact on affected users?
The attacker may gain elevated access to or control over the victim's account or session. The vulnerability has changed scope and affects confidentiality and integrity, while no availability impact is listed.