CVE-2026-18111

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...