CVE-2025-24416: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-24416) affects Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. The vulnerability was discovered by researcher wohlie and disclosed on February 11, 2025 (Adobe Bulletin, NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. It has received a CVSS v3.1 base score of 8.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. The vulnerability requires both authentication and administrative privileges to exploit (Adobe Bulletin).

When successfully exploited, the vulnerability allows malicious JavaScript execution in victims' browsers when they browse to pages containing the compromised fields. This can lead to arbitrary code execution and potential session takeover, with high confidentiality and integrity impact (NVD).

Adobe has released security updates to address this vulnerability. Users are recommended to update to Adobe Commerce versions 2.4.8-beta2 (for 2.4.8-beta1), 2.4.7-p4 (for 2.4.7-p3 and earlier), 2.4.6-p9 (for 2.4.6-p8 and earlier), 2.4.5-p11 (for 2.4.5-p10 and earlier), or 2.4.4-p12 (for 2.4.4-p11 and earlier) (Adobe Bulletin).