CVE-2026-48371

MEDIUM5.4Cross-site scripting

Description

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

Adobe / Adobe Commerce0 – 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
Adobe / Adobe Commerce2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul – 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
Adobe / Adobe Commerce B2B0 – 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
Adobe / Adobe Commerce B2B1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul – 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
Adobe / Adobe Commerce Webhooks Plugin0 – 1.20.0
Adobe / Adobe Commerce Webhooks Plugin1.21.0 – 1.21.0
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.5 – 2.4.5
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.6 – 2.4.6
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.7 – 2.4.7
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.8 – 2.4.8
Adobe / commerce2.4.9 – 2.4.9
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce2.4.4 – 2.4.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.3.4 – 1.3.4
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.4.2 – 1.4.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.2 – 1.5.2
Adobe / commerce_b2b1.5.3 – 1.5.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / commerce_b2b1.3.3 – 1.3.3
Adobe / i/o_events1.6.0 – 1.21.0
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.8 – 2.4.8
Adobe / Magento2.4.9 – 2.4.9
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.6 – 2.4.6
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento2.4.7 – 2.4.7
Adobe / Magento Open Source0 – 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
Adobe / Magento Open Source2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul – 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul

References

VENDOR_ADVISORYhttps://helpx.adobe.com/security/products/magento/apsb26-73.html

Updated 13m ago · 8 sources