Concrete CMS versions before 9.5.3 contain a stored cross-site scripting (XSS) vulnerability in the rendering of Express entry labels as raw HTML. An unauthenticated attacker can submit malicious payloads via public Express Forms, which execute in administrator dashboards or visitor browsers when viewing associated entries or Express Entry List blocks. This allows actions to be performed with the privileges of the affected user.