CVE-2026-81900
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attrib…
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
Why it matters
- ▸ CVSS vector data not available for this CVE
Apply the vendor patch as soon as it's available or already released.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
No CVSS vector data available for this CVE.
Stay Updated
New CVEs and vulnerability advisories are added continuously as they're disclosed. Subscribe via RSS to get every update the moment it's published — no email or account required.
Subscribe via RSS