Vulnerability · Published May 21, 2026 · Assigned by ConcreteCMS
CVE-2026-8203Concrete CMS 9.5.0 and below has Stored XSS on the height parameter
High 7.3
In plain English
A high-severity cross-site scripting in Concrete CMS from Concrete CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/concrete5 | 9.5.1 | GHSA-9v2g-37mp-qpxf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | 5 – through 9.5.0 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N