CVE-2025-49547 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager versions FP11.4 and earlier. This vulnerability allows an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users browse the affected pages, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No patch or vendor advisory detailing remediation is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability enables execution of malicious JavaScript in the context of affected users' browsers, which can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not impacted. The scope is changed, meaning the vulnerability may affect resources beyond the initially vulnerable component. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply best practices such as restricting access to vulnerable forms and monitoring for suspicious activity. Avoid exposing vulnerable form fields to untrusted users. Do not rely on generic mitigations that are not specific to this vulnerability.