Adobe Commerce: Stored Cross-Site Scripting (XSS)
Summary
Adobe Commerce, Adobe Commerce B2B and Magento Open Source contain a stored Cross-Site Scripting vulnerability (CWE-79) in form fields. An attacker can inject malicious scripts that run in the browser of a user who opens the page with the affected field. This can lead to privilege escalation and control over the victim's account or session. Adobe rates the issue critical (CVSS 3.1: 9.3) and requires user interaction, but a third party published a different score of 4.3. Adobe reports no known exploitation.
Affected
- Adobe Commerce: 2.4.4 through 2.4.9-2026-sep and earlier
- Adobe Commerce B2B: 1.3.3 through 1.5.3-2026-sep and earlier
- Magento Open Source: 2.4.7 through 2.4.9-2026-sep and earlier (the bulletin also lists 2.4.6)
Fixed in
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
- Note: the first 2.4.8-p5 patch file lacked the EmailAddress.php change. A corrected file was reported on October 14, 2026 (not verified).
Workaround
Unknown.
- No vendor workaround documented. Apply the patch.
Exploitation
- Adobe is not aware of any exploits in the wild for this update.
- No public proof of concept found. VulDB states no exploit is available.
- EPSS (30 days) about 0.9%. Pulse shows no KEV listing; the KEV catalogue was not checked directly.
Our recommendation
- Install the October 2026 security update (APSB26-153) for your version.
- If you applied the 2.4.8-p5 patch of October 13, check that the corrected EmailAddress.php change is present.
- Review the other APSB26-153 fixes in the same maintenance window, especially CVE-2026-103849 (CVSS 10.0).
- Check admin and customer logs for unusual script content in form fields.
- Until patched, restrict admin access to trusted networks and enforce a strict Content Security Policy.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-153 www.adobe.com
- Sansec: Blockstrap Magento RCE research sansec.io
- Meetanshi: APSB26-153 security patches meetanshi.com
- VulDB: CVE-2026-91013 vuldb.com
- Strix: CVE-2026-91013 www.strix.ai
- Pulse: CVE-2026-91013 (EPSS) pulse.kalir.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:15.
Original description (NVD)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.