CVE-2025-47110: Magento Stored XSS Vulnerability in Community Edition
Summary
CVE-2025-47110: Magneto contains stored XSS vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.5-p13
>= 2.4.6-p1, < 2.4.6-p11
>= 2.4.7-beta1, < 2.4.7-p6
>= 2.4.8-beta1, < 2.4.8-p1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, control over the look and feel of the online store, and powerful marketing tools. The community edition is a free version that allows developers to customize and extend the platform. However, certain versions of Magento have been found to be vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into form fields.
Vulnerability Detail
The stored XSS vulnerability in Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier arises from insufficient input validation in form fields. A high-privileged attacker can exploit this vulnerability to inject malicious JavaScript code, which may execute in the browser of any user who visits the affected page. This can lead to unauthorized actions, data theft, and a compromised user experience.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.5-p132.4.5-p13composer require magento/community-edition:2.4.5-p13 -
>= 2.4.6-p1, < 2.4.6-p112.4.6-p11composer require magento/community-edition:2.4.6-p11 -
>= 2.4.7-beta1, < 2.4.7-p62.4.7-p6composer require magento/community-edition:2.4.7-p6 -
>= 2.4.8-beta1, < 2.4.8-p12.4.8-p1composer require magento/community-edition:2.4.8-p1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected form fields or sanitize user inputs until the patch is applied. However, this is not a permanent solution and updating to the latest version is strongly recommended.
Conclusion
The stored XSS vulnerability in Magento poses a significant risk to users and their data. It is crucial for administrators to update their installations to the latest patched versions to protect against potential attacks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability can lead to unauthorized actions, data theft, and a compromised user experience for visitors to the affected Magento site.
Yes, you can restrict access to the affected form fields or sanitize user inputs as a temporary measure until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
