EXPOSURES › CVE-2026-91013
CVE-2026-91013
CRITICALAdobe Commerce has a stored XSS vulnerability allowing attackers to inject malicious scripts into form fields and execute them in victim browsers.
An attacker can exploit this stored XSS flaw to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon viewing the page. This can lead to session hijacking, account takeover, or data theft, directly impacting DIB organizations relying on Adobe Commerce for e-commerce or internal portals. Organizations must ensure Adobe Commerce is patched to the latest version and monitor for exploitation attempts.
Shame score — A stored XSS vulnerability is a common but avoidable flaw that, if unpatched, allows attackers to compromise user sessions and steal data, though it lacks the catastrophic impact of RCE or data breaches.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.