Vulnerability · Published Mar 4, 2026 · Assigned by ConcreteCMS
CVE-2026-3242Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Medium 4.8
In plain English
A medium-severity cross-site scripting in Concrete CMS from Concrete CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/concrete5 | 9.4.8 | GHSA-w9qg-chfh-g3q9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | 5 – before 9.4.8 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N