# CVE-2026-93659: Concrete CMS Community Store stored XSS in order fields

Source: https://junglewise.ai/threats/cve-2026-93659-concrete-cms-community-store-stored-xss-in-order-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93659 · Severity: high · CVSS 8.7 · Published 2026-09-18

Concrete CMS Community Store is an open-source e-commerce plugin that processes customer orders. Before version 2.7.8, the plugin fails to sanitize customer-supplied data (such as billing name, email, and phone) before displaying it in checkout pages and administrative views. An unauthenticated attacker can inject malicious scripts into order fields that execute when administrators view orders, allowing them to create unauthorized accounts or steal sensitive data.

Vendors: [Concrete CMS](https://junglewise.ai/threats/vendors/concrete-cms).

## Quick answers

**Is CVE-2026-93659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93659 being exploited in the wild.

**How severe is CVE-2026-93659?** High severity, with a CVSS score of 8.7, published 18 September 2026.

**Which products and versions are affected?** Concrete CMS Community Store before 2.7.8.

**Is there a fix for CVE-2026-93659?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93659 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93659?** Check whether you run Concrete CMS Community Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the Concrete CMS Community Store plugin versions before 2.7.8. The vulnerability exists because customer-supplied order fields (billing name, email, phone) are rendered in both checkout and admin views without HTML entity encoding or escaping. An unauthenticated attacker can inject JavaScript payloads during checkout that persist in the database. When an authenticated administrator accesses order management views, the malicious script executes in their browser session with their privileges, enabling account creation or data exfiltration. The attack requires no authentication to inject the payload, though exploitation of the payload requires an admin to view the affected order. A patch is available in version 2.7.8 and later.

## Affected products

- Concrete CMS Community Store before 2.7.8

## Timeline

- 2026-09-18: disclosed: CVE-2026-93659 published

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/concretecms-community-store/community_store](https://github.com/concretecms-community-store/community_store)

## Related threats

- [Concrete CMS Community Store weak digital product download tokens](https://junglewise.ai/threats/cve-2026-95653-concrete-cms-community-store-before-2-7-8-derives-digital-product)