GHSA-w9qg-chfh-g3q9

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-3242

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	concrete5/concrete5	< 9.4.8	9.4.8

Details

As written in the advisory (Markdown source, shown as plain text).

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave thanks M3dium for reporting.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-3242 advisory
https://github.com/concretecms/concretecms/pull/12826 web
https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes web
https://github.com/concretecms/concretecms package