---
id: "CVE-2026-123258"
page: "https://infrastack.ai/live/CVE-2026-123258"
kind: "vulnerability"
aliases: ["CVE-2026-123258"]
title: "Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Experience Manager", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-experience-manager", "vendor", "web-frontend"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T22:18:29+00:00"
first_seen_at: "2026-11-10T22:27:28+00:00"
updated_at: "2026-11-10T22:30:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123258", "first_seen_at": "2026-11-10T22:27:28+00:00"}]
exploit_sources: []
---

# Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts

Link for people: https://infrastack.ai/live/CVE-2026-123258 (this .md is for agents)

Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Experience Manager affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T22:27:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123258

## From the sources

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_