CVE-2026-81900

What it is

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.

At a glance

Exploitability

Can be exploited over the network with an admin-level account, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-14 23:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-16 20:47 UTC Last updatedMost recent change to the record

Details

Published

2026-09-14 23:18 UTC

Last modified

2026-09-16 20:47 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Analyzed

Affected

• Concretecms Concrete Cms < 9.5.3

Attack profile CVSS 4.0 · 7.3

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

High

User interaction

Passive

Confidentiality

High

Integrity

High

Availability

High