Stored XSS Vulnerability in Concrete CMS by Concrete CMS Team

CVE-2026-3242

What is CVE-2026-3242?

In Concrete CMS prior to version 9.4.8, an attacker with rogue administrator privileges can exploit a vulnerability in the Switch Language block, enabling the injection of stored Cross-Site Scripting (XSS). This could allow for the execution of malicious scripts within the context of users' browsers, compromising the security of affected systems. Prompt patching and regular security audits are recommended to mitigate such vulnerabilities.

References