CVE-2025-2972

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9

Description A problematic issue has been found in ConcreteCMS, affecting some unknown functionality of the component Page Attribute Display Block Handler. The manipulation of the Title argument leads to cross-site scripting. The attack may be launched remotely.

Recommendations For versions up to 9.3.9, update to a version later than 9.3.9 to resolve the issue. As a temporary workaround, consider restricting the use of the Page Attribute Display Block Handler until a patch is available. Avoid using the Title argument in the affected component to minimize the risk of exploitation.