CVE-2023-22249: Adobe Commerce stored XSS in form fields

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (4.8) and it requires high privileges plus user interaction, but the high EPSS percentile and stored nature warrant prompt patching.

What it is

Adobe Commerce versions 2.4.4-p2 and earlier and 2.4.5-p1 and earlier contain a stored cross-site scripting flaw in vulnerable form fields. A high-privileged attacker can inject malicious JavaScript that executes in a victim's browser when the victim views the affected page. Because the script is stored, it can affect multiple users over time rather than requiring a single crafted link.

Impact

An attacker can run arbitrary JavaScript in the context of a victim's authenticated session, enabling session or data theft and actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the Commerce web interface; the vector requires high privileges (PR:H) and user interaction (UI:R), meaning an authenticated high-privileged user must submit the malicious input and a victim must browse to the page containing the vulnerable field.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is high at 0.57424 (99th percentile), suggesting elevated likelihood of attempted exploitation, but the record does not confirm active exploitation.

What to do

• Apply the Adobe Commerce security update referenced in advisory APSB23-17 (2.4.4-p3 / 2.4.5-p2 or later) as the primary fix.
• Restrict and audit accounts with high privileges that can write to form fields, applying least privilege.
• Deploy input validation and output encoding for form fields, and enforce a Content Security Policy to limit script execution.
• Monitor and review stored content for injected script payloads, especially in admin-managed fields.

Detection

• Search web and application logs for script tags or event-handler attributes (e.g., onerror, onload, javascript:) submitted to form fields.
• Review stored form field content in the database for unexpected HTML or JavaScript.
• Monitor for anomalous admin or high-privilege account activity around content creation and edits.
• Alert on browser-side reports of unexpected script execution on Commerce pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.