PT-2025-42198 · Adobe · Commerce

Published 2025-10-14 · Updated 2025-10-20 · CVE-2025-54264

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9-alpha2

Description A stored Cross-Site Scripting (XSS) issue exists in Adobe Commerce that could allow a high-privileged attacker to inject malicious scripts into vulnerable form fields. Successful exploitation can lead to session takeover, impacting confidentiality and integrity. Exploitation requires user interaction, specifically a victim browsing to a page containing the vulnerable field.

Recommendations Update Adobe Commerce versions prior to 2.4.4. Update Adobe Commerce version 2.4.4. Update Adobe Commerce version 2.4.5-p14. Update Adobe Commerce version 2.4.6-p12. Update Adobe Commerce version 2.4.7-p7. Update Adobe Commerce version 2.4.8-p2. Update Adobe Commerce version 2.4.9-alpha2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54264

GHSA-2768-5WMV-CFFF

Affected Products

Commerce

References · 10

• https://helpx.adobe.com/security/products/magento/apsb25-94.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54264 · Security Note
• https://osv.dev/vulnerability/GHSA-2768-5wmv-cfff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54264 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/cveNotify/139378 · Telegram Post
• https://t.me/cveNotify/138687 · Telegram Post
• https://t.me/CVEtracker/34909 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1978225331396894799 · Twitter Post
• https://twitter.com/CVEnew/status/1978562132967841833 · Twitter Post