CVE-2026-91013

CriticalCVSS 9.3/10Last modified Nov 10, 2026

Description

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Nov 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-910147.1The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before rCVE-2026-910155.3The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates iCVE-2026-910165.3The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before retuCVE-2026-910173.7The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notificatioCVE-2026-910188.8lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code executionCVE-2026-910194.9The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuraCVE-2026-91029.4A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber fCVE-2026-910205.3The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side beforeCVE-2026-910215.4Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView noCVE-2026-910226.8The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribuCVE-2026-910233.1The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of CVE-2026-910246.8The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before
CVE-2026-91013: Critical severity, CVSS 9.3 | Vulnix