CVE-2026-81896
Received Received - Intake

Stored XSS in Concrete CMS Dashboard Form Submissions

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label that then executes in the browser of any administrator who opens the submissions report for the affected form, producing stored cross-site scripting in the Dashboard. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-81896
EUVD
EUVD-2026-78928

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS before version 9.5.3 has a stored cross-site scripting (XSS) vulnerability in the Dashboard Form Submissions report. A malicious editor can inject malicious scripts into form block question labels. When an administrator views the report, the script executes in their browser, potentially stealing data or performing unauthorized actions.

Detection Guidance

This vulnerability can be detected by checking if your Concrete CMS version is below 9.5.3. Inspect the Form block question labels in the Dashboard Form Submissions report for any stored scripts or markup. Manually review the submissions report for unexpected HTML or JavaScript execution.

Impact Analysis

If you are an administrator using Concrete CMS before 9.5.3, this vulnerability could allow attackers to steal your session cookies, perform actions on your behalf, or access sensitive data in your browser. It may also lead to further compromise of your system or data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to inadequate security measures.

Mitigation Strategies

Immediately update Concrete CMS to version 9.5.3 or later. Review and remove any suspicious Form block question labels containing scripts or markup. Monitor the Dashboard Form Submissions report for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart