CVE-2025-47110: Adobe Commerce Stored XSS Vulnerability

CVE-2025-47110 Overview

CVE-2025-47110 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw exists in vulnerable form fields that fail to properly sanitize user-supplied input before rendering it back to other users. A high-privileged attacker can inject malicious JavaScript that executes in a victim's browser when they visit the affected page. Because the vulnerability changes scope to other high-privileged accounts, successful exploitation impacts confidentiality, integrity, and availability of the targeted store.

Critical Impact
Stored XSS enables session theft, administrative action hijacking, and persistent payload delivery against Adobe Commerce admin users with elevated privileges.

Affected Products

Adobe Commerce 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier
Adobe Commerce B2B versions 1.5.2, 1.4.2-p5, 1.3.5-p10, 1.3.4-p12, 1.3.3-p13 and earlier
Magento Open Source 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12 and earlier

Discovery Timeline

2025-06-10 - CVE-2025-47110 published to NVD
2025-06-10 - Adobe publishes security advisory APSB25-50
2025-07-15 - Last updated in NVD database

Technical Details for CVE-2025-47110

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79]. Adobe Commerce stores attacker-controlled input within form fields and later reflects that input into administrative or front-end pages without adequate encoding. When a victim with high-privileged access loads the affected page, the browser parses the injected payload as executable JavaScript. The exploitation requires user interaction, meaning the victim must navigate to the page containing the poisoned field.

Scope change is the most consequential property of this flaw. Code executes within the security context of a separate, equally privileged account, enabling lateral movement across administrative roles. An attacker can use the foothold to issue privileged API calls, exfiltrate order or customer data, modify storefront content, or stage further payment-card skimming attacks consistent with Magecart-style threats.

Root Cause

The root cause is missing or insufficient output encoding when persisted form-field values are rendered into HTML responses. Input validation on write paths does not strip or neutralize HTML and JavaScript metacharacters. Output context (HTML body, attribute, or JavaScript) is not consistently encoded before rendering stored content.

Attack Vector

An attacker authenticated with high privileges submits a payload containing JavaScript into a vulnerable form field. The payload is persisted in the database. When another administrator or high-privileged user later views the page containing that field, the injected script executes in their browser session. The attacker can then steal session cookies, perform CSRF-style administrative actions, or pivot to other privileged accounts.

No verified public exploit code is available for CVE-2025-47110. Refer to the Adobe Security Advisory APSB25-50 for vendor technical details.

Detection Methods for CVE-2025-47110

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in Adobe Commerce database tables backing admin form fields
Admin user sessions performing actions inconsistent with their normal workflow, such as account modifications or storefront content changes
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing admin pages
New or modified admin users, API keys, or integration tokens created without a corresponding change request

Detection Strategies

Query Magento database tables for stored values containing HTML or JavaScript syntax in fields that should contain plain text
Inspect web server access logs for admin POST requests carrying encoded <script> payloads or unusual character sequences in form parameters
Correlate admin login events with subsequent privileged API calls to detect session reuse from anomalous source IPs
Review Content Security Policy (CSP) violation reports for inline script execution attempts on admin pages

Monitoring Recommendations

Enable verbose audit logging for all admin panel write operations and forward logs to a centralized SIEM
Monitor for changes to administrator role assignments, API keys, and integration credentials
Alert on outbound connections from admin sessions to domains not on an allowlist
Track creation of new CMS blocks, email templates, or product attribute values containing script-like content

How to Mitigate CVE-2025-47110

Immediate Actions Required

Apply the Adobe security updates referenced in advisory APSB25-50 to all Adobe Commerce, Commerce B2B, and Magento Open Source instances
Audit all admin and high-privileged accounts, removing dormant or unnecessary access
Rotate admin session cookies, API keys, and integration tokens after patching
Review stored form-field content for previously injected payloads and sanitize affected records

Patch Information

Adobe released fixed versions on June 10, 2025. Upgrade Adobe Commerce to a version newer than 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, or 2.4.4-p13. Refer to the Adobe Security Advisory APSB25-50 for the complete list of patched releases and upgrade paths.

Workarounds

Restrict admin panel access to trusted IP ranges via web server or WAF rules
Enforce a strict Content Security Policy that disallows inline script execution on admin pages
Require multi-factor authentication for all admin accounts to limit the value of stolen session cookies
Apply WAF signatures that block HTML and JavaScript metacharacters in admin form submissions until patches are deployed

bash

# Example: upgrade Adobe Commerce via Composer
composer require magento/product-community-edition=2.4.8-p1 --no-update
composer update
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush