Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block

Vulnerability

Overview

CVE-2026-3242 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.4.8. The flaw resides in the Switch Language block, where a malicious administrator can inject arbitrary JavaScript that is stored and later executed insecurely rendered. This issue was reported by researcher M3dium and fixed in commit 12826 [1][2].

Exploitation

Prerequisites

An attacker must have administrative privileges within the Concrete CMS instance to exploit this vulnerability. The attack vector is authenticated, the attacker can craft a payload within the Switch Language block's configuration. The attack is network-based (AV:N) with low complexity (AC:L) and requires user interaction (UI:P) from a victim to trigger the stored payload [1].

Impact

Successful exploitation allows the attacker to execute malicious scripts in the context of another user's session when they interact with the affected block. The CVSS v4.0 score is 4.8, reflecting a low impact on integrity (VI:L) and no impact on confidentiality or availability. The vulnerability does not affect the availability of the system [1].

Mitigation

Concrete CMS version 9.4.8 includes the fix for this vulnerability. Users are strongly advised to upgrade to this version or later. No workarounds have been publicly documented [2].