CVE-2026-68528
Deferred Deferred - Pending Action

Stored XSS in Concrete CMS RSS Displayer Block

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including administrators, without holding an account on that site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-68528
EUVD
EUVD-2026-76164

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS RSS Displayer block below version 9.5.3 had a stored cross-site scripting vulnerability. It rendered remote feed item titles without HTML escaping, allowing attackers to inject malicious scripts via controlled feed titles. These scripts execute in the site origin for any visitor, including administrators, without requiring an account on the site.

Detection Guidance

To detect this vulnerability, check the version of Concrete CMS installed on your system. The affected versions are below 9.5.3. You can use commands like 'composer show concrete/concrete' or check the version in the admin panel. Inspect pages using the RSS Displayer block for stored XSS by reviewing feed content and rendered HTML output.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Administrators visiting affected pages risk full site compromise. The vulnerability requires no authentication, making it accessible to remote attackers.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Both standards require safeguards against such exploits.

Mitigation Strategies

Immediately update Concrete CMS to version 9.5.3 or higher to patch the vulnerability. If updating is not possible, disable the RSS Displayer block or restrict access to it. Review and sanitize any syndicated feed content to remove potential malicious scripts before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart