CVE-2026-81900: Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with editblock permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
A user needs edit_block permission to modify a YouTube block. They can store a malicious value in the block's width or height field that executes when another user renders the affected page.
Which users are at risk when viewing an affected page?
Any visitor who renders a page containing the malicious YouTube block can trigger the stored script. If the viewer is an administrator, the script executes with that administrator's privileges.
Are default YouTube block configurations affected?
The issue requires malicious width or height values to have been stored in a YouTube block. The provided information does not indicate that ordinary, unmodified block values trigger the vulnerability.
How can I identify potentially affected content?
Review YouTube blocks for width or height values containing more than normal numeric dimension input, particularly values that include event-handler-like content. The vulnerable behavior applies to versions before 9.5.3.