Adobe Commerce stored XSS in form field
CVE-2026-47995 Published on July 14, 2026

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-47995 can be exploited with network access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Exploitation:

NONE

Automatable:

NO

Technical Impact:

TOTAL

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-47995 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2026-47995

Want to know whenever a new CVE is published for Adobe products? stack.watch will email you.

Adobe Commerce

  Watch

Adobe Commerce

  Watch

Adobe Commerce B2b

  Watch

Adobe Magento Open Source

  Watch

Affected Versions

• Before and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 is affected.
• Version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul is unaffected.

• Before and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 is affected.
• Version 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul is unaffected.

• Before and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 is affected.
• Version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul is unaffected.

• Before and including 1.20.0 is affected.
• Version 1.21.0 is unaffected.

Exploit Probability