EXPOSURES › CVE-2026-100133
CVE-2026-100133
CRITICALAdobe Commerce has a stored XSS vulnerability allowing attackers to inject malicious scripts into form fields and execute them in victim browsers.
A stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce enables attackers to inject malicious JavaScript into vulnerable form fields. When victims browse pages containing these fields, the scripts execute in their browsers, potentially leading to account takeover or session hijacking. DIB organizations using Adobe Commerce must ensure timely patching and input validation to prevent such attacks.
Shame score — A stored XSS vulnerability is a common but serious flaw that, if unpatched, allows attackers to compromise user sessions and escalate privileges within the application.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.