What is CVE-2026-93659?

CVE-2026-93659 is a high-severity vulnerability in Concretecms-Community-Store Community Store, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-09-18.

How severe is CVE-2026-93659?

High severity. CVSS v3 base score is 8.7 out of 10.

XSS in Concretecms-Community-Store Community Store

CVE-2026-93659

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Affected products

Concretecms-community-store Community_store

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-93659?: CVE-2026-93659 is a high-severity vulnerability in Concretecms-Community-Store Community Store, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-09-18.
How severe is CVE-2026-93659?: High severity. CVSS v3 base score is 8.7 out of 10.