CVE-2025-24413: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2025-24413: Magento Stored Cross-Site Scripting (XSS) Vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition are susceptible to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into form fields.
Vulnerability Detail
The vulnerability arises from insufficient input validation in Magento's form fields, allowing low-privileged attackers to inject malicious JavaScript code. When a victim visits a page containing the compromised field, the injected script executes in their browser, potentially leading to session hijacking and unauthorized access to sensitive information. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and it poses a high risk to the confidentiality and integrity of user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected form fields or implement input validation to sanitize user inputs until the patch is applied. However, this is not a permanent solution and should be followed by an update.
Conclusion
The stored XSS vulnerability in Magento Community Edition poses significant risks to user data and application integrity. It is crucial for users to update to the latest patched versions to safeguard against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Affected versions include Magento Community Edition 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker could exploit this vulnerability to execute malicious scripts in a victim's browser, leading to session takeover and unauthorized access to sensitive information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
