CVE-2025-24417: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2025-24417: Magento Stored Cross-Site Scripting (XSS) Vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, control over the look, content, and functionality of online stores. It is known for its rich feature set, including marketing, search engine optimization, and catalog-management tools. However, certain versions of Magento Community Edition are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by low-privileged attackers.
Vulnerability Detail
The vulnerability arises from insufficient input validation in vulnerable form fields, allowing attackers to inject malicious JavaScript code. When a victim accesses a page containing the compromised field, the injected script executes in their browser, potentially leading to session hijacking and unauthorized access to sensitive information. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), with a CVSS score of 8.7, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected form fields by implementing input validation and sanitization on the server side. This can help mitigate the risk of XSS attacks until the package is updated. However, this is not a complete solution and should not replace the necessary updates.
Conclusion
The stored XSS vulnerability in Magento Community Edition poses a significant risk to users and their data. It is essential to update to the latest patched versions to mitigate this risk effectively. Regular monitoring and adherence to security best practices will help maintain the integrity of your application.
See every vulnerability recorded for magento/community-edition →
FAQ
A stored XSS vulnerability allows attackers to inject malicious scripts into web applications, which are then stored on the server and executed in the browsers of users who access the affected page.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without requiring a signup.
If exploited, this vulnerability can lead to session hijacking, unauthorized access to user accounts, and compromise of sensitive data, severely impacting the confidentiality and integrity of the application.
Yes, implementing proper input validation, output encoding, and using security libraries can help prevent XSS attacks. Regularly updating your software also mitigates risks.
If immediate updates are not possible, consider applying input validation and sanitization as a temporary workaround, but plan to update to the patched versions as soon as feasible.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
