Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93659Concrete CMS Community Store before 2.7.8 Stored XSS
High 8.1
In plain English
A high-severity cross-site scripting in community_store from concretecms-community-store. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| concretecms-community-store | community_store | 0 – before 2.7.8 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- Add escaping of values patch
- Unescaped order fields at v2.7.7 technical-description
- community_store v2.7.8 Release Notes release-notes
- https://github.com/concretecms-community-store/community_store product
- VulnCheck Advisory: Concrete CMS Community Store before 2.7.8 Stored XSS third-party-advisory