CVE-2026-81894

Concrete CMS 9.5.2 and below contains a stored DOM-based cross-site scripting (XSS) flaw in the Gallery block's per-image Caption field: the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) takes the attribute-decoded caption and re-parses it as HTML through jQuery's .append() in the titleSrc option instead of inserting it as plain text. A user with permission to edit a page containing a Gallery block can store a malicious caption, and that payload executes in the browser of any visitor who opens that image's lightbox. Successful exploitation lets the attacker run arbitrary JavaScript as the victim — enabling session hijacking, credential theft, and content manipulation — effectively escalating a page editor's limited privileges to those of administrators and ordinary site visitors. The Concrete CMS security team rated it CVSS v4.0 8.5 (high). No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Upgrade Concrete CMS to a release newer than 9.5.2 (the latest 9.x) and clear page caches so the patched frontend.js is served to visitors. Audit existing Gallery block captions for HTML or script payloads and review edit history for suspicious changes by low-privilege editors. Restrict who can edit pages containing Gallery blocks, and rotate sessions for users who may have viewed a compromised lightbox.