Vulnerability Description
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/concretecms-community-store/community_store
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/eleme
- https://github.com/concretecms-community-store/community_store/commit/2a802d6a57
- https://github.com/concretecms-community-store/community_store/releases/tag/v2.7
- https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-s
FAQ
What is CVE-2026-93659?
CVE-2026-93659 is a vulnerability with a CVSS score of 8.7 (HIGH). Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name,...
How severe is CVE-2026-93659?
CVE-2026-93659 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93659?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.