Executive brief
Concrete CMS Community Store is an open-source e-commerce plugin that processes customer orders. Before version 2.7.8, the plugin fails to sanitize customer-supplied data (such as billing name, email, and phone) before displaying it in checkout pages and administrative views. An unauthenticated attacker can inject malicious scripts into order fields that execute when administrators view orders, allowing them to create unauthorized accounts or steal sensitive data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Concrete CMS Community Store plugin versions before 2.7.8. The vulnerability exists because customer-supplied order fields (billing name, email, phone) are rendered in both checkout and admin views without HTML entity encoding or escaping. An unauthenticated attacker can inject JavaScript payloads during checkout that persist in the database. When an authenticated administrator accesses order management views, the malicious script executes in their browser session with their privileges, enabling account creation or data exfiltration. The attack requires no authentication to inject the payload, though exploitation of the payload requires an admin to view the affected order. A patch is available in version 2.7.8 and later.
Affected products
- Concrete CMS Community Store before 2.7.8
Timeline
- 2026-09-18: disclosed: CVE-2026-93659 published