Concrete CMS Community Store before 2.7.8 Stored XSS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93659 · Microsoft / collected KEV context

cve-program · CVE-2026-93659

• https://github.com/concretecms-community-store/community_store/commit/2a802d6a5717f4e351ef21fdf8bdaf8061c40109
• https://github.com/concretecms-community-store/community_store/blob/v2.7.7/elements/order_slip.php
• https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8
• https://github.com/concretecms-community-store/community_store
• https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-stored-xss

No related operational record is retained in the current change model.