SAP Commerce Cloud versions - 1808 1811 1905 2005 does not sufficiently encode user inputs which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered if an affected web page is visited resulting in Cross-Site Scripting (XSS) vulnerability.