Sign in
Deutsch English Español Polski
High

Magento Open Source allows Cross-Site Scripting (XSS)

  • Disclosed: 15.02.2024
  • Updated: 11.10.2026 12:17

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
Composer package magento/project-community-edition <= 2.0.2 no fix
Magento (core) magento/community-edition >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-79
Platform
Composer, Magento
Package
magento/community-edition, magento/project-community-edition
Disclosed
15.02.2024
Updated
11.10.2026 12:17

Sources and licenses

OSV / GitHub Advisory Database - GHSA-264g-f7v8-q5qq - CC BY 4.0

Vulnerability history: magento/project-community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
11.2019 10.2025
Without a fix
160
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 48
  • Medium 77
  • Low 12

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 <= 2.0.2 no fix
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 <= 2.0.2 no fix
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.0.2 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 <= 2.0.2 no fix
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 <= 2.0.2 no fix
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 <= 2.0.2 no fix
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 <= 2.0.2 no fix
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 <= 2.0.2 no fix
  9. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 <= 2.0.2 no fix
  10. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 <= 2.0.2 no fix
  11. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 <= 2.0.2 no fix
  12. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 <= 2.0.2 no fix
  13. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 <= 2.0.2 no fix
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 <= 2.0.2 no fix
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 <= 2.0.2 no fix
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 <= 2.0.2 no fix
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 <= 2.0.2 no fix
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 <= 2.0.2 no fix
  19. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 <= 2.0.2 no fix
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 <= 2.0.2 no fix
  21. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 <= 2.0.2 no fix
  22. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 <= 2.0.2 no fix
  23. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 <= 2.0.2 no fix
  24. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 <= 2.0.2 no fix
  25. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 <= 2.0.2 no fix
  26. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 <= 2.0.2 no fix
  27. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 <= 2.0.2 no fix
  28. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 <= 2.0.2 no fix
  29. Magento Open Source allows Cross-Site Scripting (XSS) this entry
    High · 9.1 CVE-2024-20719 <= 2.0.2 no fix
  30. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 <= 2.0.2 no fix
  31. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 <= 2.0.2 no fix
  32. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 <= 2.0.2 no fix
  33. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 <= 2.0.2 no fix
  34. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-29297 <= 2.0.2 no fix
  35. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 <= 2.0.2 no fix
  36. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 <= 2.0.2 no fix
  37. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 <= 2.0.2 no fix
  38. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 <= 2.0.2 no fix
  39. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 <= 2.0.2 no fix
  40. Magento has an XML Injection vulnerability
    Critical CVE-2021-36028 <= 2.0.2 no fix
  41. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Critical · 9.1 CVE-2021-36025 <= 2.0.2 no fix
  42. Magento is affected by an os command injection via the Data collection endpoint
    High · 7.2 CVE-2021-36024 <= 2.0.2 no fix
  43. Magento XML Injection vulnerability in the Widgets Module
    Critical CVE-2021-36033 <= 2.0.2 no fix
  44. Magento allows attackers to alter the price of items
    High CVE-2021-36030 <= 2.0.2 no fix
  45. Magento improper authorization vulnerability
    High · 7.2 CVE-2021-36029 <= 2.0.2 no fix
  46. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    High CVE-2021-36031 <= 2.0.2 no fix
  47. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    High · 8.0 CVE-2021-36043 <= 2.0.2 no fix
  48. Magento executes code via the API File Option Upload Extension
    Critical · 9.1 CVE-2021-36042 <= 2.0.2 no fix
  49. Magento vulnerable to file upload attack
    High · 7.2 CVE-2021-36041 <= 2.0.2 no fix
  50. Magento affected by remote code execution via a file upload
    High · 7.2 CVE-2021-36034 <= 2.0.2 no fix
  51. Magento has a file extension restrictions bypass
    Critical · 9.1 CVE-2021-36040 <= 2.0.2 no fix
  52. Magento affected by a server-side denial-of-service using a GraphQL field
    High · 7.5 CVE-2021-36044 <= 2.0.2 no fix
  53. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    High · 7.5 CVE-2021-28583 <= 2.0.2 no fix
  54. Magento stored cross-site scripting (XSS) in the customer address upload feature
    High · 8.1 CVE-2021-21030 <= 2.0.2 no fix
  55. Magento vulnerable to a file upload restriction bypass
    Critical · 9.1 CVE-2021-21014 <= 2.0.2 no fix
  56. Magento XPath Injection
    Critical · 9.1 CVE-2021-21025 <= 2.0.2 no fix
  57. Magento OS command injection via the WebAPI
    Critical · 9.1 CVE-2021-21016 <= 2.0.2 no fix
  58. Magento 2 Community Edition RCE via Unsafe File Upload
    Critical · 9.1 CVE-2020-24407 <= 2.0.2 no fix
  59. Magento DOM-based Cross-site scripting vulnerability
    Critical · 9.6 CVE-2020-9691 <= 2.0.2 no fix
  60. Magento business logic error vulnerability
    Critical · 9.8 CVE-2020-9630 <= 2.0.2 no fix
  61. Magento security mitigation bypass vulnerability
    Critical · 9.8 CVE-2020-9632 <= 2.0.2 no fix
  62. Magento security mitigation bypass vulnerability
    Critical · 9.8 CVE-2020-9631 <= 2.0.2 no fix
  63. Magento Defense-in-depth security mitigation vulnerability
    Critical · 9.8 CVE-2020-9585 <= 2.0.2 no fix
  64. Magento command injection vulnerability
    Critical · 9.8 CVE-2020-9583 <= 2.0.2 no fix
  65. Magento Signature verification bypass
    High · 7.2 CVE-2020-9588 <= 2.0.2 no fix
  66. Magento command injection vulnerability
    Critical · 9.8 CVE-2020-9582 <= 2.0.2 no fix
  67. Magento authorization bypass vulnerability
    High · 7.5 CVE-2020-9587 <= 2.0.2 no fix
  68. Magento command injection vulnerability
    Critical · 9.8 CVE-2020-9578 <= 2.0.2 no fix
  69. Magento Security mitigation bypass vulnerability
    Critical · 9.8 CVE-2020-9580 <= 2.0.2 no fix
  70. Magento command injection vulnerability
    Critical · 9.8 CVE-2020-9576 <= 2.0.2 no fix
  71. Magento 2 Community Edition RCE Vulnerability
    High · 7.2 CVE-2019-8114 < 1.9.4.3 1.9.4.3
  72. Unauthenticated crypto and weak IV in Magento\Framework\Encryption
    High · 7.5 CVE-2016-6485 >= 2.0, <= 2.0.2 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.