CVE-2025-54266: Adobe Commerce Stored XSS Vulnerability

CVE-2025-54266 Overview

CVE-2025-54266 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a high-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim later browses to a page containing the affected field, the injected script executes in their browser session. Adobe published the issue on October 14, 2025 under advisory APSB25-94. The vulnerability is classified as [CWE-79] and carries a scope change, meaning injected code can impact resources beyond the vulnerable component.

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions in the context of authenticated Commerce users, including administrators who view the affected pages.

Affected Products

Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier
Adobe Commerce B2B 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.5-p12, 1.3.4-p14, 1.3.3-p15 and earlier
Magento Open Source (equivalent branches through 2.4.9-alpha2)

Discovery Timeline

2025-10-14 - CVE-2025-54266 published to NVD
2025-10-14 - Adobe releases security advisory APSB25-94
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54266

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Adobe Commerce admin and storefront interfaces. Certain form fields fail to properly sanitize or encode user-supplied input before persisting it to the database. When the stored content is later rendered on a page, the browser interprets the payload as executable JavaScript rather than inert data. Because the scope is changed, the injected script can affect security-relevant components outside the injection point, such as authenticated admin sessions.

Exploitation is not trivial: the attacker must already hold high privileges within the Commerce application. However, a compromised or malicious staff account can pivot this access into full administrative takeover by targeting higher-privileged users who later view the injected content.

Root Cause

The underlying weakness maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. Vulnerable Commerce form handlers accept input containing HTML or script tokens and store the raw value without applying output-context encoding when the field is rendered. Adobe has not disclosed the specific fields or template files affected in APSB25-94.

Attack Vector

The attack is network-based and requires authentication as a high-privileged user plus subsequent user interaction from a victim. A typical exploitation flow proceeds as follows:

The attacker authenticates to the Adobe Commerce admin panel with an account that has permission to edit a vulnerable form field.
The attacker submits a JavaScript payload into the field, which the application stores in the backend database.
A second user, often a higher-privileged administrator, navigates to a page that renders the stored value.
The victim's browser executes the payload in the origin of the Commerce site, allowing session cookie theft, CSRF token exfiltration, or unauthorized administrative actions.

No verified public proof-of-concept is available. Refer to the Adobe Security Advisory APSB25-94 for vendor-supplied technical detail.

Detection Methods for CVE-2025-54266

Indicators of Compromise

Presence of <script>, onerror=, onload=, or javascript: tokens inside Commerce database fields that should contain plain text (product attributes, customer profile fields, CMS blocks).
Admin audit log entries showing edits to configuration or catalog fields by staff accounts immediately followed by anomalous admin-session activity.
Outbound requests from browsers viewing Commerce admin pages to unknown domains, consistent with cookie or token exfiltration.

Detection Strategies

Query the Commerce database for stored values matching common XSS patterns across fields such as catalog_product_entity_text, CMS block content, and B2B company profile attributes.
Enable and review the Adobe Commerce admin action log for unusual edits by high-privileged users.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions in admin and storefront pages.

Monitoring Recommendations

Forward web server and Commerce application logs to a centralized analytics platform and alert on suspicious admin POST bodies containing script markup.
Monitor admin session activity for concurrent logins from disparate geolocations following field edits.
Track browser CSP violation reports for script-src and inline-script violations originating from admin URIs.

How to Mitigate CVE-2025-54266

Immediate Actions Required

Apply the security updates listed in Adobe advisory APSB25-94 to all Adobe Commerce, Adobe Commerce B2B, and Magento Open Source instances.
Review and reduce the number of accounts holding admin, catalog-edit, or B2B company-management privileges.
Rotate admin session keys and force re-authentication after patching, in case stored payloads were already delivered.

Patch Information

Adobe addressed CVE-2025-54266 in the October 14, 2025 security release for Commerce and Magento Open Source. Fixed versions are published in the Adobe Security Advisory APSB25-94. Administrators should upgrade to the corresponding patch level for their branch (for example, the successor releases to 2.4.8-p2, 2.4.7-p7, and 2.4.6-p12).

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts and untrusted external script sources in both admin and storefront contexts.
Restrict admin panel access to trusted networks using IP allow-listing at the web server or reverse proxy layer.
Require multi-factor authentication for all Commerce admin and B2B management accounts to raise the bar for the prerequisite high-privileged access.

bash

# Example nginx snippet: restrict Commerce admin panel and enforce CSP
location ^~ /admin {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
}