CVE-2026-68528

Concrete CMS versions below 9.5.3 are vulnerable to a stored cross-site scripting (XSS) flaw in the RSS Displayer block . The root cause is that remote feed item titles are rendered without HTML escaping. An attacker who can control a title in a syndicated feed can inject script that executes in ...