Cpe:2.3:a:concretecms:community_store:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aconcretecmscommunity_store/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 16:09:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in Concrete CMS Community Storehttps://feed.craftedsignal.io/briefs/2026-09-concrete-cms-xss/Fri, 18 Sep 2026 16:09:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-concrete-cms-xss/An unauthenticated stored XSS vulnerability in Concrete CMS Community Store versions prior to 2.7.8 allows attackers to execute malicious scripts in manager sessions via order fields.Concrete CMS Community Store versions before 2.7.8 are susceptible to a stored cross-site scripting (XSS) vulnerability due to improper input sanitization. The vulnerability exists because customer-supplied fields, specifically billing name, email, and phone, are rendered in the store's checkout and administrative interfaces without adequate HTML escaping. An unauthenticated attacker can exploit this flaw by submitting malicious JavaScript payloads through these fields during the order process. When an administrator or manager subsequently views the order details within the Concrete CMS dashboard, the malicious script executes within the context of the manager's authenticated session. This allows the attacker to perform unauthorized actions, including the creation of rogue administrative accounts or the exfiltration of sensitive order and customer data.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to hijack administrative sessions, leading to full site compromise, unauthorized administrative actions, and potential data exfiltration. Given that the Community Store is a core component for e-commerce functionality, the impact covers all Concrete CMS instances utilizing this plugin, potentially affecting the integrity and confidentiality of store transaction data and administrative controls.

Recommendation

  • Upgrade the Concrete CMS Community Store plugin to version 2.7.8 or later immediately.
  • Implement a web application firewall (WAF) rule to block common XSS payloads in parameters associated with billing or checkout forms.
  • Audit existing order records in the administrative console for suspicious script injection patterns in billing name, email, or phone fields.
]]>highadvisory