CVE-2026-93659
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Concrete CMS Community Store before version 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Risk Assessment
Risk: creation of rogue accounts or data exfiltration as scripts execute in authenticated manager sessions.
Recommendation
Update the Concrete CMS Community Store plugin to version 2.7.8 or later, which includes the fix for proper escaping.
Other vulnerabilities in Concrete CMS Community Store
Original NVD description (English source)
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS