Stored XSS in Concrete CMS Community Store Affects User Data
CVE-2026-93659
9.3CRITICAL
What is CVE-2026-93659?
The Concrete CMS Community Store prior to version 2.7.8 is vulnerable to a stored XSS issue where customer-supplied data in order fields, such as billing name, email, and phone number, is not properly sanitized. This flaw enables unauthenticated attackers to inject malicious scripts that execute during authenticated manager sessions, potentially leading to unauthorized account creation or exfiltration of sensitive data. Users are advised to upgrade to the latest version to mitigate this risk.
Affected Version(s)
community_store 0 < 2.7.8
community_store 2.7.8