CVEvulnerability
CVE-2026-93659
8.6 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-18
- Last modified
- 2026-09-28
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-79
Description
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/concretecms-community-store/community_store github.com
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/elements/order_slip.php github.com
- https://github.com/concretecms-community-store/community_store/commit/2a802d6a5717f4e351ef21fdf8bdaf8061c40109 github.com
- https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8 github.com
- https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-stored-xss www.vulncheck.com