Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

This XSS vulnerability poses a significant threat to Adobe Commerce deployments. An attacker can inject malicious JavaScript code into form fields, which will then be executed in the browsers of unsuspecting users who visit the affected page. This can lead to session hijacking, allowing the attacker to impersonate the user and gain unauthorized access to their account and sensitive data. The impact is particularly severe because the vulnerability requires only user interaction – a victim simply needs to visit the page containing the malicious script. The potential for widespread compromise is high, especially in environments with shared user accounts or where user input is not properly sanitized.

Organizations using Adobe Commerce, particularly those running versions 2.4.4-p16 and earlier, are at risk. Deployment patterns involving custom form extensions or integrations that handle user input without proper sanitization are especially vulnerable. Shared hosting environments where multiple tenants share the same Adobe Commerce instance should also be prioritized for patching.

• wordpress / composer / npm:

grep -r 'vulnerable_form_field_name' /var/www/html/app/code/Magento/...

• generic web:

curl -I https://example.com/vulnerable_form_page.html | grep -i 'x-xss-protection'

• generic web:

curl -I https://example.com/vulnerable_form_page.html | grep -i 'content-security-policy'

1. 2026-03-11Disclosure

   disclosure

1. Reserviert2025-12-12
2. Veröffentlicht2026-03-11
3. Geändert2026-03-12
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-21284 is to upgrade to a patched version of Adobe Commerce. Adobe recommends upgrading to version 2.4.9 or later. If immediate upgrading is not possible, consider implementing temporary workarounds such as strict input validation and output encoding on all form fields. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense. Carefully review and update any custom code that handles user input to ensure proper sanitization. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a vulnerable form field and verifying that it is not executed.