CVE-2026-81918

Received Received - Intake

Stored XSS in Concrete CMS via Date Format Field

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type attribute. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81918

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Concrete CMS versions below 9.5.3 have a stored cross-site scripting (XSS) vulnerability in the Date Format field of the Page Attribute Display block. An attacker with edit_page_contents permissions can inject malicious scripts that execute in the browsers of users viewing pages with this block configured for date-type attributes.

Detection Guidance

Check Concrete CMS version with command: grep -r 'Concrete CMS' /path/to/installation. If version is below 9.5.3, the system is vulnerable. Inspect Page Attribute Display blocks for Date Format fields containing suspicious scripts.

Impact Analysis

This vulnerability allows attackers to steal user sessions, perform actions on behalf of users, or deface websites. Users viewing affected pages could have their browsers compromised, leading to data theft or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance violations if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or higher immediately. Remove edit_page_contents permissions from untrusted users until patched. Review and sanitize all Date Format fields in Page Attribute Display blocks.

Hi! I’m here to help you understand CVE-2026-81918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70