Description
Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | concrete5/concrete5 | < 9.1.0 | 9.1.0 | GHSA-fgxj-g7x3-85cq |