What’s Vulnerable › Vulnerabilities

CVE-2021-36027: Magento Commerce Stored Cross-site Scripting Vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-01 · updated 2026-06-17
• Weakness: CWE-79

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Affected products

• Adobe Commerce: from 2.3.0 through 2.3.7; from 2.4.0 through 2.4.2; 2.4.2-p1
• Adobe Magento Open Source: from 2.3.0 through 2.3.7; from 2.4.0 through 2.4.2; 2.4.2-p1
• Adobe Magento Commerce: through 2.4.2; through 2.4.2-p1; through 2.3.7; through None

References

• https://helpx.adobe.com/security/products/magento/apsb21-64.html
• https://helpx.adobe.com/security/products/magento/apsb21-64.html

Get alerted when CVE-2021-36027 or the next vulnerability affects your stack