| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | = 2.4.4= 2.4.5= 2.4.6= 2.4.7≥ 2.4.5-p1, < 2.4.5-p8≥ 2.4.6-p1, < 2.4.6-p6< 2.4.4-p9 | 2.4.5-p82.4.6-p62.4.4-p9 |
| commerce | = 2.3.7= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.6 | |
| commerce webhooks | ≥ 1.2.0, ≤ 1.4.0 | |
| magento | = 2.4.4= 2.4.5= 2.4.6= 2.4.7 |
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free