CVE-2026-18119CWE-79cross-site-scripting

CVE-2026-18119

Critical · published September 15, 2026

CVSS v3.1
9.0
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.0 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-15T00:16Z
Affected products (1)
ProductVersionsFixed in
concretecms/concrete_cms< 9.5.39.5.3
References (1)
https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes · ff5b8ace-8b95-4078-9743-eac1ca5451de
EPSS history
Timeline
  • 16 SEP 04:25Z
    EPSS moved — → 0%
    epss
  • 14 SEP 19:54Z
    Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
    cvelistv5