EUVD-2026-76164
GHSA-rq97-c8jm-449q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker must control a subscribed RSS feed (AC:H); no site credentials required (PR:N); victim must load the affected page (UI:R); injected script executes in site origin scope change (S:C).
Primary rating from Vendor (ConcreteCMS).
CVSS VectorVendor: ConcreteCMS
Lifecycle Timeline
1DescriptionCVE.org
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including administrators, without holding an account on that site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
AnalysisAI
Stored cross-site scripting in Concrete CMS's RSS Displayer block (versions below 9.5.3) allows an external attacker who controls a syndicated feed to inject arbitrary JavaScript into any page that renders that feed, executing in the site origin for all visitors including authenticated administrators. The attack requires no account on the vulnerable site; the malicious payload persists across all page loads until the feed content changes or the block is removed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent prerequisites: (1) the target site must run Concrete CMS below version 9.5.3 with the RSS Displayer block deployed on at least one active page; (2) the block must be configured to fetch a feed whose content the attacker can influence - via direct ownership of the feed host, compromise of the feed origin server, or a MITM on an HTTP (non-HTTPS) feed URL; and (3) a victim must load the affected page after the malicious payload is present in the feed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor's CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, score 6.0) accurately reflects the nuanced threat profile: the attack is network-reachable and requires no site credentials, but the attacker must first control or compromise a specific RSS feed that a site editor has already subscribed to, making mass opportunistic exploitation impractical - even a mid-sized municipal IT team in radom should treat this as a targeted supply-chain-style risk rather than a drive-by threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Concrete CMS 9.5.3 or later; the release introduces proper HTML encoding for RSS Displayer block feed item titles and is the only confirmed fix per the vendor advisory at https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Concrete Cms
View allA bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Co
Concrete5 through 8.5.5 deserializes Untrusted Data. Rated high severity (CVSS 7.2), this vulnerability is remotely expl
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File
Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. Rated high severity
A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to at
Unauthenticated file usage disclosure in Concrete CMS 9.5.0 and below exposes internal page structure to any network-acc
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "ca
Concrete CMS versions below 9.4.8 contain a cross-site request forgery vulnerability in the Anti-Spam Allowlist Group Co
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire in
Unauthenticated information disclosure in Concrete CMS 9.5.0 and earlier allows remote attackers to enumerate all conver
Unauthenticated information disclosure in Concrete CMS 9.5.0 and below allows any network-accessible attacker to enumera
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insec
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today