medium4.8
CVE-2026-3242
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Impact
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave thanks M3dium for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 9.4.8 | 9.4.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 9.4.8 |