Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Successful exploitation of CVE-2026-21291 allows an attacker to inject arbitrary JavaScript code into Adobe Commerce. This code executes within the context of the victim's browser when they interact with the affected form field. The attacker could then steal session cookies, redirect users to malicious websites, deface the website, or perform other actions as the victim user. Because the vulnerability requires user interaction, the attacker needs to entice a user to visit the compromised page. The blast radius is limited to users who interact with the malicious form field, but the potential impact on those users can be significant, including account takeover and data theft.

Organizations using Adobe Commerce versions 0–2.4.4-p16, particularly those with high-traffic storefronts or sensitive customer data, are at risk. Shared hosting environments where multiple tenants share the same Adobe Commerce instance are also at increased risk, as a compromise on one tenant's account could potentially affect others.

• magento / web:

grep -r "<script" /var/www/html/app/code/Magento/...

• magento / web:

curl -I https://your-magento-site.com/form-page | grep Content-Security-Policy

• wordpress / composer / npm: Review plugin code for improper output encoding of user-supplied data in form fields. • generic web: Monitor access logs for unusual requests targeting form submission endpoints.

1. 2026-03-11Disclosure

   disclosure

1. Reserviert2025-12-12
2. Veröffentlicht2026-03-11
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-21291 is to upgrade Adobe Commerce to a version that includes the fix. Adobe has not released a specific fixed version in the provided data; consult the official Adobe Commerce security advisories for the latest patched release. As a temporary workaround, consider implementing strict input validation and output encoding on all form fields to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. Regularly review and update security policies and procedures to minimize the risk of XSS vulnerabilities.