GHSA-3j7w-jp46-9752
GitHub Security Advisory
Magento Open Source allows Cross-Site Scripting (XSS)
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.
Affected Packages
Packagist
magento/community-edition
Affected versions:
2.4.7-beta1
(fixed in 2.4.7-beta2)
Packagist
magento/community-edition
Packagist
magento/community-edition
Packagist
magento/community-edition
Packagist
magento/community-edition
Affected versions:
2.4.6-p1
(fixed in 2.4.6-p3)
Packagist
magento/community-edition
Affected versions:
2.4.5-p1
(fixed in 2.4.5-p5)
Packagist
magento/community-edition
Affected versions:
2.4.4-p1
(fixed in 2.4.4-p6)
Packagist
magento/project-community-edition
Affected versions:
0
(last affected: 2.0.2)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: August 1, 2025 6:44 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.