CVE-2026-3242
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Summary
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Original description
The description as published by the source.
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web documentation.concretecms.org