CVE-2026-68528: Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including administrators, without holding an account on that site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Operational
After upgrading to Concrete CMS 9.5.3 or later, review and remove any malicious content that may have been stored via unescaped RSS Displayer Block remote feed item titles (Stored XSS).
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites running Concrete CMS 9.5.2 or earlier are exposed if they use an RSS Displayer block that renders a feed whose item titles can be controlled by an attacker. Visitors to the affected page, including administrators, can be targeted.
Does an attacker need an account on the Concrete CMS site?
No. The attacker does not need an account on the affected site, but must be able to control an item title in a syndicated feed used by the site's RSS Displayer block.
What conditions are required for exploitation?
A victim must visit a page that displays the malicious feed item title. The CVSS vector also indicates high attack complexity and that user interaction is required.
What version addresses the issue?
The issue affects versions below 9.5.3, so upgrading to Concrete CMS 9.5.3 or later addresses the vulnerable rendering behavior.