CVE-2026-93659 is a high severity (CVSS 8.1) stored cross-site scripting flaw in Concrete CMS Community Store before 2.7.8. Unauthenticated visitors can store script in order fields that later run in a manager's browser session. The fix is Community Store 2.7.8.
What's affected
The record says Community Store before 2.7.8 is affected, and the project has a v2.7.8 release with a commit titled to add escaping of values. The weakness is CWE-79, cross-site scripting.
The record describes customer supplied order fields, including billing name, email and phone, being rendered without HTML escaping in checkout and admin views. An unauthenticated attacker can store script there. It runs when an authenticated manager opens the order, which the record says can be used to create rogue accounts or pull data out.
The repository's v2.7.7 order slip template is among the references, which suggests 2.7.7 and earlier are in scope. I could not read the release notes page in full, so confirm the exact range against the project's changelog.
How to check if you're exposed
Community Store is a Concrete CMS add-on. Check the installed version in the dashboard's add-on or package list, or read the version value in the package's controller file.
grep -n "pkgVersion" packages/community_store/controller.php
Anything below 2.7.8 is in scope. If you manage the code through Composer, check your lock file for the community_store package.
Then look at recent orders for odd content in the billing name, email or phone fields, such as markup instead of plain text.
What to do now
- Update Community Store to 2.7.8 or later and clear caches.
- Review recent orders for unexpected markup in billing fields. If you find any, treat sessions that opened those orders as exposed.
- Review the list of manager accounts and recent account creation for anything you do not recognize.
- Ask store managers to sign out and back in after the update, and to avoid opening orders with odd content until the patch is live.
- Consider a Content Security Policy for the admin area to limit what injected script can do.
Why it matters
Stored XSS is high value for attackers when the victim is a privileged user. The visitor never needs an account. They only need to place an order, and the payload waits in the database until a manager looks at it. CWE-79 comes down to output that should have been escaped for the HTML context and was not.
The record does not flag exploitation and the CVE is not in CISA's catalog. The scoring reflects the need for a manager to open the page. In a shop that processes orders daily, that is not a strong barrier.
Quick check
Do attackers need an account on my store?
No. The record describes unauthenticated attackers storing script through checkout fields.
What fixes it?
Community Store 2.7.8, which adds escaping of values according to the project's commit.
Sources
Last reviewed: 18 October 2026.
