NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

CVE-2025-47110: Magneto contains stored XSS vulnerability

criticalCVSS 3.1 9.1GHSA-j934-vjh5-vf9r

Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Published Jun 10, 2025 · Updated Jun 24, 2025

Affected packages

magento/community-edition

Ecosystem
Composer (PHP)
Affected
>= 2.4.8-beta1, < 2.4.8-p1
Fixed in
2.4.8-p1
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
>= 2.4.7-beta1, < 2.4.7-p6
Fixed in
2.4.7-p6
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
< 2.4.5-p13
Fixed in
2.4.5-p13
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
= 2.4.7
Fixed in
No patched version yet
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
= 2.4.8
Fixed in
No patched version yet
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
= 2.4.5
Fixed in
No patched version yet
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
>= 2.4.6-p1, < 2.4.6-p11
Fixed in
2.4.6-p11
Check
composer show magento/community-edition

magento/community-edition

Ecosystem
Composer (PHP)
Affected
= 2.4.6
Fixed in
No patched version yet
Check
composer show magento/community-edition

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries