GHSA-w9qg-chfh-g3q9

ghsaUSosv

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

view advisory published 2026-03-04Licence: CC-BY-4.0

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave thanks M3dium for reporting.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-3242US	medium4.8	0.21% (11th)	—	2026-03-04
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 sc…

references

External citations — patches, advisories, analysis.

https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notesWEB
https://github.com/concretecms/concretecmsPACKAGE
https://github.com/concretecms/concretecms/pull/12826WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-3242ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan