---
id: CVE-2026-93659
title: >-
  Concrete CMS Community Store before 2.7.8 renders customer-supplied order
  fields without HTML escaping in checkout and admin views
summary: >-
  Concrete CMS Community Store before 2.7.8 renders customer-supplied order
  fields without HTML escaping in checkout and admin views. Unauthenticated
  attackers can store script payloads in billing name, email, or phone fields
  that execute …
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: concretecms-community-store
product: concretecms-community-store/community_store
affected:
  - concretecms-community-store/community_store < 2.7.8
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:55:25.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93659'
references:
  - url: 'https://github.com/concretecms-community-store/community_store'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/concretecms-community-store/community_store/blob/v2.7.7/elements/order_slip.php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/concretecms-community-store/community_store/commit/2a802d6a5717f4e351ef21fdf8bdaf8061c40109
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-stored-xss
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00468
epssPercentile: 0.37832
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/prince325/CVE-2026-93659-writeup'
  checkedAt: '2026-09-25T08:21:25.072Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:59:43.487671Z'
ingestedAt: '2026-09-18T14:43:13.069Z'
---

## Overview

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.