CVE-2026-93659highCWE-79

CVE-2026-93659: high-severity vulnerability in concretecms-community-store community_store

Concrete CMS Community Store before 2.7.8 Stored XSS

Published · Updated

Follow this CVE+ Monitor community store

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.6epss 0.4%
from disclosure to weapon1 day
Published on NVDSep 18
1st PoC+1d
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
concretecms-community-store · community_store
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — concretecms-community-store community_store

In the same product, most dangerous first.

CVE-2026-95653HIGHConcrete CMS Community Store before 2.7.8 Predictable Digital Download TokenEPSS 0.6%