Concrete CMS versions 9.0.0 through 9.5.2 contain a stored cross-site scripting (XSS) vulnerability in the Board Custom Slot dialog. This flaw allows a user with permission to edit board contents to inject JavaScript code into the description field of a summary object, which is then rendered without proper encoding. The vulnerability affects both anonymous front-end visitors and authenticated dashboard users who view the affected board slot. Versions prior to 9.0.0 are not affected as they lack the Boards feature.