CVE-2025-24414: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2025-24414: Magento Stored Cross-Site Scripting (XSS) Vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that provides a flexible shopping cart system, control over the look and feel of the online store, and a range of features for managing products, customers, and orders. The platform is highly customizable and supports various payment gateways and shipping methods. However, certain versions of Magento Community Edition are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into form fields.
Vulnerability Detail
The vulnerability arises from insufficient input validation in specific form fields within Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged attacker can exploit this flaw to inject malicious JavaScript code. When a victim accesses a page containing the compromised field, the script executes in their browser, potentially leading to session takeover and compromising the confidentiality and integrity of user data. The CVSS score for this vulnerability is 8.7, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the vulnerable form fields or sanitize user inputs to prevent script injection. However, the best approach is to apply the available patches as soon as possible.
Conclusion
The stored XSS vulnerability in Magento Community Edition poses a significant risk to users and their data. It is crucial to update to the latest patched versions to safeguard against potential attacks. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for magento/community-edition →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected page.
You can check your Magento version against the affected versions listed in the vulnerability details. Additionally, you can use Vulert to monitor your application for vulnerabilities.
If left unaddressed, this vulnerability can lead to session hijacking, data theft, and unauthorized access to sensitive information, severely compromising your users' security.
Yes, you can implement input validation and output encoding to mitigate the risk of XSS attacks until you can apply the official patch.
Vulert uses your composer.lock file to monitor and alert you in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
