← CVE Intelligence

CVE-2026-81918

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block PUBLISHED

Description (CNA)

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type attribute. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.

Affected (CNA)

Vendor / productVersions
Concrete CMS / Concrete CMSaffected 5.0.0 through 9.5.2

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.