CVE-2026-81894
Received Received - Intake

Stored DOM-based XSS in Concrete CMS via Gallery Block Caption

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attribute-decoded caption as HTML through jQuery's .append() in titleSrc instead of inserting it as text. A user with permission to edit a page containing a Gallery block can store a caption that executes in the browser of any visitor who opens that image's lightbox. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-81894
EUVD
EUVD-2026-78833

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions 9.5.2 and below have a stored DOM-based Cross-site Scripting (XSS) vulnerability in the Gallery block's per-image Caption field. The issue occurs because the Magnific Popup lightbox script re-parses the caption as HTML instead of plain text, allowing malicious scripts to execute in the browser of any visitor who opens the image's lightbox.

Detection Guidance

Check Concrete CMS versions below 9.5.3 for the Gallery block's Caption field. Inspect page source for stored XSS payloads in image captions. Look for Magnific Popup script usage in concrete/js/features/imagery/frontend.js.

Impact Analysis

A user with page editing permissions can inject malicious scripts via the Gallery block's caption. When other users view the image in the lightbox, the script executes in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing unauthorized actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected Concrete CMS versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or higher. Remove or sanitize user input in Gallery block captions. Disable Magnific Popup script if not required. Implement input validation for all user-provided content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart