CVE-2025-49557: Magento Community Edition Cross-Site Scripting Vulnerability
Summary
CVE-2025-49557: Magento Cross-site Scripting vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p15
>= 2.4.5-p1, < 2.4.5-p14
>= 2.4.6-p1, < 2.4.6-p12
>= 2.4.7-p1, < 2.4.7-p7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is an open-source e-commerce platform that provides businesses with a flexible and scalable solution for online selling. It offers a wide range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by low-privileged attackers to inject malicious scripts into form fields.
Vulnerability Detail
The vulnerability arises from improper validation of user input in form fields, allowing attackers to inject malicious scripts. This can lead to privilege escalation within the application or compromise sensitive user data. Exploitation requires user interaction, as a victim must visit the page containing the vulnerable field. The affected versions include Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier. The CVSS score for this vulnerability is 8.7, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p152.4.4-p15composer require magento/community-edition:2.4.4-p15 -
>= 2.4.5-p1, < 2.4.5-p142.4.5-p14composer require magento/community-edition:2.4.5-p14 -
>= 2.4.6-p1, < 2.4.6-p122.4.6-p12composer require magento/community-edition:2.4.6-p12 -
>= 2.4.7-p1, < 2.4.7-p72.4.7-p7composer require magento/community-edition:2.4.7-p7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before processing. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2025-49557 vulnerability in Magento Community Edition poses a significant risk due to its potential for XSS attacks. It is crucial for users to update to the latest patched versions to protect their applications from exploitation. Implementing proper input validation can also serve as a temporary measure until the update is applied.
See every vulnerability recorded for magento/community-edition →
FAQ
It is a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields.
Affected versions include Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
If you cannot update immediately, ensure that user input is sanitized and validated to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
