CVE-2026-3241

The record

In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.

Affected packages

Related vulnerabilities

• GHSA-f4vq-pj32-gr4q Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Same vulnerability
• GHSA-w9qg-chfh-g3q9 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• GHSA-45fj-fvmm-xcc5 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• GHSA-6mxw-2vhf-42g5 Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) Also affects concrete5/concrete5
• GHSA-gj26-w59c-29mf Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection Also affects concrete5/concrete5
• GHSA-mm5f-5rqw-574f Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• CVE-2026-3242 In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the… Also affects concrete5/concrete5
• CVE-2026-2994 Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the… Also affects concrete5/concrete5