CVE-2026-8353

MediumCVSS 4.8/10Last modified Jul 23, 2026

Description

Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 22, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-835304.3A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, andCVE-2026-835318.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language StatemCVE-2026-835326.8The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering themCVE-2026-835335.3The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an orCVE-2026-835346.4PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arCVE-2026-835357.4A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer SCVE-2026-835365.3A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such CVE-2026-835375.3The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an orCVE-2026-83546.4The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions upCVE-2026-835408.8When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticatedCVE-2026-835416.8The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within CVE-2026-835434.1The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with con