CVE-2026-93659: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in concretecms-community-store community_store
CVE-2026-93659 is a critical cross-site scripting (XSS) vulnerability in Concrete CMS Community Store versions before 2.7.8. It allows unauthenticated attackers to inject malicious scripts into customer order fields such as billing name, email, or phone. These scripts execute in authenticated manager sessions, potentially enabling rogue account creation or data exfiltration.
AI Analysis
Technical Summary
Concrete CMS Community Store prior to version 2.7.8 improperly neutralizes input during web page generation by rendering customer-supplied order fields without HTML escaping in checkout and admin views. This flaw permits unauthenticated attackers to store script payloads in billing-related fields, which execute in the context of authenticated manager sessions. The vulnerability is classified as cross-site scripting (XSS) and has a CVSS 4.0 base score of 9.3, indicating critical severity.
Potential Impact
The vulnerability allows unauthenticated attackers to execute arbitrary scripts in the context of authenticated manager sessions. This can lead to unauthorized actions such as creating rogue accounts or exfiltrating sensitive data accessible to managers. The high CVSS score reflects the potential for significant impact on confidentiality and integrity within affected installations.
Mitigation Recommendations
A fix is available in Concrete CMS Community Store version 2.7.8. Users should upgrade to version 2.7.8 or later to remediate this vulnerability. No alternative mitigations are indicated in the provided data.
CVE-2026-93659: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in concretecms-community-store community_store
Description
CVE-2026-93659 is a critical cross-site scripting (XSS) vulnerability in Concrete CMS Community Store versions before 2.7.8. It allows unauthenticated attackers to inject malicious scripts into customer order fields such as billing name, email, or phone. These scripts execute in authenticated manager sessions, potentially enabling rogue account creation or data exfiltration.
CVSS v4.0
Score 9.3critical
Affected software
concretecms-community-store
community_store
pkg:composer/concretecms-community-store/community_storeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS Community Store prior to version 2.7.8 improperly neutralizes input during web page generation by rendering customer-supplied order fields without HTML escaping in checkout and admin views. This flaw permits unauthenticated attackers to store script payloads in billing-related fields, which execute in the context of authenticated manager sessions. The vulnerability is classified as cross-site scripting (XSS) and has a CVSS 4.0 base score of 9.3, indicating critical severity.
Potential Impact
The vulnerability allows unauthenticated attackers to execute arbitrary scripts in the context of authenticated manager sessions. This can lead to unauthorized actions such as creating rogue accounts or exfiltrating sensitive data accessible to managers. The high CVSS score reflects the potential for significant impact on confidentiality and integrity within affected installations.
Mitigation Recommendations
A fix is available in Concrete CMS Community Store version 2.7.8. Users should upgrade to version 2.7.8 or later to remediate this vulnerability. No alternative mitigations are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-18T13:30:26.287Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad805355bf5e2cf55e7ad5
Added to database: 09/18/2026, 18:17:55 UTC
Last enriched: 09/18/2026, 18:31:28 UTC
Last updated: 09/18/2026, 18:52:48 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.