CVE-2025-2963

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9

Description A problematic issue has been found in ConcreteCMS, affecting the addEditQuestion function of the Legacy Form Block Handler component. The manipulation of the Question argument leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For versions up to 9.3.9, as a temporary workaround, consider disabling the addEditQuestion function of the Legacy Form Block Handler component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.