CVE-2026-68528: Concrete CMS RSS Displayer XSS Vulnerability

CVE-2026-68528 Overview

CVE-2026-68528 is a stored cross-site scripting (XSS) vulnerability in the Concrete CMS RSS Displayer block affecting versions below 9.5.3. The block rendered remote feed item titles without HTML escaping, allowing script content to execute in the site origin. An attacker who controls a title in a syndicated feed can execute JavaScript against any visitor to the affected page, including administrators. Exploitation requires no account on the target site. The Concrete CMS security team assigned this issue a CVSS v4.0 score of 6.0. The vulnerability is tracked under CWE-79 and was reported by riodrwn.

Critical Impact
Script execution in the site origin allows session theft, administrative action forgery, and content manipulation for any visitor of a page that renders a malicious RSS feed.

Affected Products

Concrete CMS versions below 9.5.3
Concrete CMS RSS Displayer block component
Sites configured to render third-party or attacker-controllable RSS feeds

Discovery Timeline

2026-09-11 - CVE-2026-68528 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-68528

Vulnerability Analysis

The RSS Displayer block in Concrete CMS fetches items from a remote RSS or Atom feed and renders them within a page. Prior to version 9.5.3, the block wrote feed item titles directly into HTML output without applying escaping or sanitization. Because the injected content executes in the site's origin, an attacker gains full DOM access and can perform actions as the viewing user.

Any visitor loading the affected page triggers the payload, including authenticated administrators. This transforms a syndicated content feature into a persistent script injection sink for stored XSS.

Root Cause

The root cause is missing output encoding in the RSS Displayer template that processes remote feed data. Feed titles arrive from an untrusted third-party source but were treated as safe HTML rather than untrusted text. The pattern maps directly to CWE-79, improper neutralization of input during web page generation.

Attack Vector

Exploitation requires an attacker to control the content of a syndicated feed consumed by the target site. The attacker publishes a feed item with a title containing HTML or JavaScript, then waits for the target Concrete CMS site to fetch and render the feed. When a visitor loads the page, the browser parses the malicious title and executes attacker-supplied script within the site origin. User interaction is limited to visiting the affected page, which administrators do routinely.

No verified public exploit code is available at this time. See the ConcreteCMS Version 9.5.3 Release Notes for vendor details.

Detection Methods for CVE-2026-68528

Indicators of Compromise

RSS feed item titles containing <script>, <img onerror=>, or other HTML tags rather than plain text.
Outbound HTTP requests from browsers viewing CMS pages to unexpected attacker-controlled hosts.
Unexpected administrator session activity or new privileged accounts created shortly after RSS feed refresh events.

Detection Strategies

Review the HTML source of pages rendering the RSS Displayer block for unescaped tags inside feed item title elements.
Log and inspect the URLs of all feeds configured in the RSS Displayer block, flagging feeds hosted outside vetted domains.
Correlate RSS fetch timestamps in web server logs with subsequent anomalous administrator actions.

Monitoring Recommendations

Monitor Concrete CMS audit logs for changes to user roles, permissions, and installed packages following RSS feed updates.
Alert on Content Security Policy (CSP) violation reports originating from pages hosting the RSS Displayer block.
Track version inventory of Concrete CMS instances and flag any installation below 9.5.3.

How to Mitigate CVE-2026-68528

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later on all instances.
Audit all pages using the RSS Displayer block and identify the source feed URLs in use.
Remove or replace RSS Displayer blocks that consume feeds from untrusted or unverified sources.

Patch Information

Concrete CMS addressed the vulnerability in version 9.5.3 by applying HTML escaping to remote feed item titles rendered by the RSS Displayer block. Administrators should apply the upgrade following the guidance in the ConcreteCMS Version 9.5.3 Release Notes.

Workarounds

Temporarily remove the RSS Displayer block from public pages until the upgrade is complete.
Restrict RSS Displayer usage to feeds hosted on infrastructure fully controlled by the site operator.
Deploy a strict Content Security Policy that blocks inline script execution to reduce the impact of stored XSS payloads.

bash

# Example restrictive CSP header to reduce XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'