Vulnerability Report

CVE-2026-93659

Title: Cross-site Scripting (XSS) in Concrete CMS Community Store

XSS

Proof Of Concept

PoC Available for CVE-2026-93659

CWE Category CWE-79

Published Date Sep 18, 2026

Modified Date Sep 22, 2026

Exploit Status Available

Score 9.3 CVSS v4.0

Exploit Probability (EPSS)

0.47%

Vulnerability Summary

CVE-2026-93659: Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/concretecms-community-store/community_store https://github.com/concretecms-community-store/community_store/blob/v2.7.7/elements/order_slip.php https://github.com/concretecms-community-store/community_store/commit/2a802d6a5717f4e351ef21fdf8bdaf8061c40109 https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8 https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-stored-xss

CVSS v4.0

Source Entity [email protected]

Severity CRITICAL

9.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

PASSIVE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-93659 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/prince325/CVE-2026-93659-writeup

View Code

September 22, 2026 MODIFIED

Vulnerability data updated via NVD.

September 18, 2026 MODIFIED

Vulnerability data updated via NVD.

September 18, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction PASSIVE

CVSS Vector String


                                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.