{"id":"CVE-2026-81918","title":"Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block","summary":"Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed …","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"concretecms","product":"concrete_cms","affected":["concrete_cms < 9.5.3"],"patched":["concrete_cms 9.5.3"],"published":"2026-09-11","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:05:21.497","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81918","references":[{"url":"https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes","label":"ff5b8ace-8b95-4078-9743-eac1ca5451de"}],"tags":["nvd","cve.org"],"epss":0.00181,"epssPercentile":0.07969,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T12:49:30.715533Z"},"ingestedAt":"2026-09-14T15:23:07.428Z","slug":"CVE-2026-81918","body":"## Overview\n\nConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type attribute. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.\n\n## Affected\n\n- `concrete_cms < 9.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `concrete_cms 9.5.3`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}