CVE-2026-93659: Concrete CMS Community Store before 2.7.8 Stored XSS
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Concrete CMS Community Store versions before 2.7.8 are affected. The vulnerable fields are customer-supplied billing name, email, and phone values rendered in checkout and administrative views.
What does an attacker need to exploit this issue?
An attacker can submit a script payload through order fields without authentication. Exploitation requires an authenticated manager to later view the stored order data, which triggers the payload in that manager's browser session.
Are default-facing checkout workflows exposed?
Yes. The affected inputs are checkout order fields, so any deployment that accepts customer order details and has managers review those orders may be exposed.
What can happen if exploitation succeeds?
The script executes in an authenticated manager session and may be used to create unauthorized accounts or exfiltrate data available to that session.
What should be done if an immediate upgrade is not possible?
The provided data identifies version 2.7.8 as the fixed release. Until upgrading, reduce exposure by preventing untrusted order-field content from being rendered in manager sessions where possible; the data does not provide a specific supported workaround.