Cross-site scripting in Adobe products - CVE-2026-48413

Vulnerability identifier: #VU141504

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-48413

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to cross-site scripting (stored XSS) in Magento Open Source when rendering stored content. A remote user can inject crafted script content to execute arbitrary code.

User interaction is required.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-aug, 1.3.4-2026-aug, 1.4.2-2026-aug, 1.5.2-2026-aug, 1.5.3-2026-aug
Magento Open Source - addressed in versions 2.4.6-2026-aug, 2.4.7-2026-aug, 2.4.8-2026-aug, 2.4.9-2026-aug
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-aug, 2.4.5-2026-aug, 2.4.6-2026-aug, 2.4.7-2026-aug, 2.4.8-2026-aug, 2.4.9-2026-aug

• https://helpx.adobe.com/security/products/magento/apsb26-92.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source