CVE-2026-93659

Community Store, the e-commerce add-on for Concrete CMS, renders customer-supplied order fields such as billing name, email, and phone number without HTML escaping in both checkout and admin order views. An unauthenticated attacker can submit an order containing JavaScript in those fields, and the payload executes when a manager or administrator later views the order in the dashboard. Because the script runs inside an authenticated staff session, the attacker can create rogue user accounts or exfiltrate data from the CMS. All sites running Community Store versions before 2.7.8 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade Community Store to 2.7.8 or later on all Concrete CMS sites. Until patched, review recently submitted orders for script tags or suspicious content in the billing name, email, and phone fields before opening them in the dashboard, and audit the user list for unauthorized manager or admin accounts. Treat any unexpected administrator accounts or unexplained dashboard activity as possible signs of prior exploitation.