CVE-2026-21292 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

🗓️ 11 Mar 2026 02:19:16Reported by adobeType

Adobe Commerce stored cross site scripting in two four x versions; low-privilege attacker injects scripts via vulnerable fields when a user visits the page.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-21292	11 Mar 202602:19	–	attackerkb
BDU FSTEC	The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.	17 Mar 202600:00	–	bdu_fstec
CNNVD	Adobe Commerce 跨站脚本漏洞	11 Mar 202600:00	–	cnnvd
CNVD	Adobe Commerce Cross-Site Scripting Vulnerability (CNVD-2026-16584)	17 Mar 202600:00	–	cnvd
CVE	CVE-2026-21292	11 Mar 202602:19	–	cve
EUVD	EUVD-2026-11049	11 Mar 202602:19	–	euvd
EUVD	EUVD-2026-11050	11 Mar 202603:31	–	euvd
NCSC	Vulnerabilities fixed in Adobe Commerce	12 Mar 202606:49	–	ncsc
NVD	CVE-2026-21292	11 Mar 202603:15	–	nvd
OSV	CVE-2026-21292 Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)	11 Mar 202602:19	–	osv

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.4-p16",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/magento/apsb26-05.html

11 Mar 2026 02:19Current

CVSS 3.15.4

EPSS0.00255

CWE-79