Concrete CMS versions prior to 9.5.3 are vulnerable to a stored XSS attack via the Date Format field in the Page Attribute Display block. An attacker with edit_page_contents privileges can store a malicious payload that executes in the browser context of any visitor viewing a page where the block displays a date-type attribute. The vulnerability is tracked as CVE-2026-81918 and has a CVSS v4.0 score of 4.8 (AV:N/AC:L/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N). No known exploits in the wild have been reported.

An attacker with edit_page_contents permissions can inject stored malicious scripts that execute in the browsers of users viewing affected pages. This can lead to unauthorized script execution, potentially enabling session hijacking or other client-side attacks. However, the attack requires elevated privileges (edit_page_contents) and user interaction (viewing the page), limiting the impact severity to medium.

Upgrade Concrete CMS to version 9.5.3 or later, where this vulnerability has been fixed. Since the vulnerability affects versions below 9.5.3, applying the official update remediates the issue. No other mitigation guidance is provided or necessary.