CVE-2026-81894

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...

CVE-2026-81894

Concrete CMS 9.5.2 and below contains a stored DOM-based XSS in the Gallery block's per-image Caption field. The root cause is that the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attribute-decoded caption as HTML via jQuery's .append() in title...

CVE-2026-81894: Improper Neutralization of Special Elements used in an SQL Command

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...