CVE-2025-49534 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager versions FP11.4 and earlier. It allows attackers with low privileges to inject malicious JavaScript into form fields, which executes in the context of users who visit the affected pages. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of affected users, potentially compromising confidentiality and integrity of user data. There is no impact on availability. The vulnerability requires user interaction and low privileges to exploit. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Adobe's advisories for updates. Until a fix is available, consider restricting access to vulnerable form fields or applying web application firewall (WAF) rules to detect and block malicious script injection attempts.