CVE-2026-18111

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered without output escaping. A user with page-editing permissions (such as Add Block combined with Edit Contents on a single page) could store a crafted external link value that broke out of the link markup and injected arbitrary JavaScript. The script executed in the browser session of any user who subsequently viewed, previewed, or edited the affected page, which could lead to session hijacking and escalation of privileges up to full administrative takeover. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks to KhanMarshai for reporting this issue.

• CWE-306

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes

Published

Sep 15, 2026

Last Modified

Sep 22, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18106IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3
• CVE-2026-18107A flaw was found in CRIU's handling of restartable sequences…7.8
• CVE-2026-18108Net::SAML2 versions before 0.86 for Perl allow authenticatio…9.8
• CVE-2026-18109The W3 Total Cache plugin for WordPress is vulnerable to Sto…7.2
• CVE-2026-1811A flaw has been found in bolo-blog bolo-solo up to 2.6.4. Th…8.8
• CVE-2026-18110Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an aut…7.5
• CVE-2026-18113In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block d…7.5
• CVE-2026-18115Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_u…7.4
• CVE-2026-18116Concrete CMS 8.3.0 to 9.5.2 stored calendar event names with…6.1
• CVE-2026-18117Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS…7.3
• CVE-2026-18119Concrete CMS below 9.5.3 did not sanitize custom style value…9
• CVE-2026-1812A vulnerability has been found in bolo-blog bolo-solo up to …9.8