Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Multiple Stored XSS Vulnerabilities in Adobe Commerce

Updated 3mo agoFirst seen Mar 13, 20264 sources

Adobe Commerce disclosed multiple stored cross-site scripting (XSS) vulnerabilities affecting versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16, and earlier. The issues tracked as CVE-2026-21284, CVE-2026-21290, CVE-2026-21311, and CVE-2026-21361 allow malicious JavaScript to be injected into vulnerable form fields and later executed in a victim’s browser when the affected page is viewed. Adobe indicates the impact can include session takeover and high confidentiality and integrity risk.

The vulnerabilities differ primarily in the privilege level required to plant the payload, with most requiring a high-privileged attacker and at least one (CVE-2026-21290) being exploitable by a low-privileged attacker. In all cases, exploitation requires user interaction, as a victim must browse to the page containing the injected content. A separate write-up about a chained exploit involving postMessage misconfiguration, prompt injection, and sandbox escape on an AI assistant platform does not describe the same Adobe Commerce disclosure and should be excluded.

Share:
Multiple Stored XSS Vulnerabilities in Adobe Commerce
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

Start free trial
EVENT TIMELINE

How this story unfolded

1 event from the most recent confirmed update back to the earliest known activity.

1 EVENTS
Mar 11, 20263mo ago

Adobe discloses multiple Adobe Commerce stored XSS vulnerabilities

Adobe Commerce vulnerabilities CVE-2026-21284, CVE-2026-21290, CVE-2026-21311, and CVE-2026-21361 were published as stored cross-site scripting flaws affecting multiple versions up to specific patch levels, including 2.4.9-alpha3 in several cases. The issues could allow attackers to inject malicious scripts into form fields and potentially hijack user sessions when victims view affected pages.

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

2 LINKEDOpen in app
Affected products
1 linked
Adobe Commerce
Organizations
1 linked
Adobe
SOURCE COVERAGE

Sources

4 references tracked. Mallory keeps watching after this page renders.

4 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Start free trial
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.

Multiple Stored XSS Vulnerabilities in Adobe Commerce | Mallory