CVE-2026-92911
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be…
- Risk score
- 64/100
- CVSS
- 8.7 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
References
Original description
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Last activity 13 Oct 2026. Patch Forecast updates every hour.