BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-20

Assigner: Adobe Systems Incorporated

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-20

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54266

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.6
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.7
adobe	commerce	2.4.8
adobe	commerce	2.4.8
adobe	commerce	2.4.8
adobe	commerce	2.4.8
adobe	commerce	2.4.8
adobe	commerce	2.4.9
adobe	commerce	2.4.9
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.3
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.4
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.3.5
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.4.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.5.2
adobe	commerce_b2b	1.5.3
adobe	commerce_b2b	1.5.3
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.6
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.7
adobe	magento	2.4.8
adobe	magento	2.4.8
adobe	magento	2.4.8
adobe	magento	2.4.8
adobe	magento	2.4.8
adobe	magento	2.4.9
adobe	magento	2.4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in Adobe Commerce versions up to 2.4.9-alpha2 and earlier. A high-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses to the page containing the injected script, the malicious code executes in their browser. Exploitation requires the victim to interact by visiting the affected page.

Impact Analysis

The vulnerability can lead to malicious scripts running in the browsers of users who visit the affected pages. This can result in theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim. Since exploitation requires user interaction and a high-privileged attacker, the risk is moderate but can still compromise user security and trust.

Hi! I’m here to help you understand CVE-2025-54266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70