CVE-2023-44766

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-10-06 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.

Affected products

Concrete CMS: 9.2.1

References

https://github.com/sromanhu/ConcreteCMS-Stored-XSS---SEO
https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766
https://github.com/sromanhu/ConcreteCMS-Stored-XSS---SEO
https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766

Get alerted when CVE-2023-44766 or the next vulnerability affects your stack