Stored XSS in Concrete CMS Community Store Affects User Data
CVE-2026-93659

8.6HIGH

Key Information:

Vendor: Concretecms-community-store
Status: Community Store
Vendor: CVE Published:; 18 September 2026

🔔 Create Concretecms-community-store Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-93659?

The Concrete CMS Community Store prior to version 2.7.8 is vulnerable to a stored XSS issue where customer-supplied data in order fields, such as billing name, email, and phone number, is not properly sanitized. This flaw enables unauthenticated attackers to inject malicious scripts that execute during authenticated manager sessions, potentially leading to unauthorized account creation or exfiltration of sensitive data. Users are advised to upgrade to the latest version to mitigate this risk.

Affected Version(s)

community_store 0 < 2.7.8

community_store 2.7.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-93659-writeup
Created by prince325