CVE-2025-24415: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2025-24415: Magento Stored Cross-Site Scripting (XSS) Vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, control over the look, content, and functionality of online stores. It is known for its robust features, scalability, and extensive customization options. However, certain versions of Magento Community Edition are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into form fields.
Vulnerability Detail
The vulnerability arises from inadequate input validation in specific form fields within Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged attacker can exploit this flaw to inject malicious JavaScript code. When a victim accesses a page containing the compromised field, the malicious script executes in their browser, potentially leading to session takeover and significant impacts on confidentiality and integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected form fields or implement input sanitization to mitigate the risk of XSS attacks until the package is updated. However, this is not a permanent solution, and updating to the patched version is strongly recommended.
Conclusion
The stored XSS vulnerability in Magento Community Edition poses a significant risk to users, allowing attackers to inject malicious scripts that can compromise user sessions and data integrity. It is crucial to update to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for magento/community-edition →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected page.
You can check your Magento version against the affected versions listed in the vulnerability details. Additionally, you can use Vulert to monitor your application for vulnerabilities without needing to access the code.
Exploitation of this vulnerability can lead to session hijacking, data theft, and unauthorized actions performed on behalf of the victim, significantly compromising the security of the application.
Yes, implementing proper input validation, output encoding, and using security libraries can help mitigate the risk of XSS attacks.
Vulert is a tool that monitors open-source vulnerabilities in your software using the composer.lock file. It provides real-time alerts for vulnerabilities, helping you maintain the security of your applications.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
