CVE-2026-18111

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Concrete CMS versions prior to 8.5.21

Description Stored cross-site scripting (XSS) exists in the Feature, Feature Link, Hero Image, and Image blocks. The issue occurs because the external link URL is insufficiently validated by the link filter and rendered without output escaping. A user with page-editing permissions can store a crafted external link value to inject arbitrary JavaScript. This script executes in the browser session of any user who views, previews, or edits the affected page, potentially leading to session hijacking and full administrative takeover.

Recommendations Update Concrete CMS to version 9.5.3 or later. Update Concrete CMS to version 8.5.21 or later.