PT-2026-89999

CVE-2026-68528

Published

2026-09-11

Updated

2026-09-11

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description The RSS Displayer block fails to perform HTML escaping on remote feed item titles, leading to stored cross-site scripting (XSS). An attacker who can control a title within a syndicated feed can execute arbitrary scripts in the site origin for any visitor to the affected page, including administrators, without requiring an account on the site.

Recommendations Update to version 9.5.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Riodrwn

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers