CVE-2025-24412: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2025-24412: Magento Stored Cross-Site Scripting (XSS) Vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a range of features including product management, customer segmentation, and marketing tools. However, certain versions of Magento Community Edition are vulnerable to a stored Cross-Site Scripting (XSS) attack, which could allow attackers to inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability arises from improper validation of user input in form fields, allowing low-privileged attackers to inject malicious JavaScript. When a victim visits a page containing the vulnerable field, the injected script may execute in their browser, potentially leading to session hijacking and unauthorized access to sensitive information. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and it poses a high risk to the confidentiality and integrity of user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected form fields or sanitize user input before processing it. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The stored XSS vulnerability in Magento Community Edition poses a significant risk to users and their data. It is crucial to update to the latest patched versions to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining the security of your e-commerce platform.
See every vulnerability recorded for magento/community-edition →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected page.
You can check your Magento version against the affected versions listed in the vulnerability report. Additionally, you can use Vulert to monitor your application for vulnerabilities.
An XSS attack can lead to session hijacking, data theft, and unauthorized actions performed on behalf of the user, compromising the security of the application.
Yes, implementing input validation, output encoding, and using security libraries can help mitigate the risk of XSS attacks. However, the best approach is to apply patches provided by the software vendor.
Vulert is a tool that monitors open-source vulnerabilities in your software using the composer.lock file. It provides real-time alerts for vulnerabilities, helping you maintain the security of your applications.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
