CVE-2026-93659 — Concrete CMS Community Store before 2.7.8 Stored XSS
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script pa…
Published: 2026-09-18 · CVSS: 8.6 · CVSS 4.0
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7