Stored Cross-Site Scripting Vulnerability in Concrete CMS by Concrete CMS

CVE-2026-3241

What is CVE-2026-3241?

A stored cross-site scripting (XSS) vulnerability exists in the 'Legacy Form' block of Concrete CMS prior to version 9.4.8. This flaw allows an authenticated user with permissions to create or edit forms to inject malicious JavaScript into form options. The injected payload can be executed in the browser of any user viewing the affected form, potentially compromising user data and security by exposing them to unwanted scripts. It highlights the importance of securing form input and implementing proper validation to prevent unauthorized script execution.

References