Description
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| concretecms-community-store | community_store | < 2.7.8 | 2.7.8 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
prince325/CVE-2026-93659-writeup ★ 0 · Sep 19, 2026
Stored XSS in Concrete CMS Community Store leads to admin dashboard takeover
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Add escaping of values patch
- Unescaped order fields at v2.7.7 technical-description
- community_store v2.7.8 Release Notes release-notes
- https://github.com/concretecms-community-store/community_store product
- VulnCheck Advisory: Concrete CMS Community Store before 2.7.8 Stored XSS third-party-advisory