CVE-2026-91013: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Commerce
Description
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields. When a victim views the affected page, the malicious script may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating.
CVSS v3.1
Score 9.3critical
Affected software
Adobe
Adobe Commerce
Adobe
Adobe Commerce B2B
Adobe
Magento Open Source
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91013 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce. Attackers can exploit vulnerable form fields to inject malicious JavaScript, which executes in the context of a victim's browser upon visiting the affected page. This can result in unauthorized actions or session hijacking. The vulnerability has a CVSS v3.1 score of 9.3, indicating critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts.
Potential Impact
Successful exploitation can lead to execution of arbitrary JavaScript in the victim's browser, potentially allowing attackers to hijack user sessions, steal sensitive information, or perform actions with the victim's privileges within Adobe Commerce. The confidentiality and integrity impacts are rated high, but availability is not affected.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted input fields and consider applying any recommended workarounds from Adobe.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- adobe
- Date Reserved
- 2026-09-14T16:29:14.498Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace79ba2cdf04f656972480
Added to database: 10/13/2026, 18:34:34 UTC
Last enriched: 10/13/2026, 18:48:52 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.