Concrete CMS versions prior to 9.4.8 allow an authenticated user with form‑creation or editing privileges to embed a persistent JavaScript payload into the options of a multiple‑choice question in the Legacy Form block. When any user views a page containing that form, the stored script runs in the visitor’s browser. The flaw is a data‑injection vulnerability (CWE‑79) that exposes users to arbitrary client‑side code execution but does not provide direct server‑side code execution or data exfiltration from the CMS itself.

All releases of Concrete CMS before 9.4.8 are affected. Users on 9.4.8 or later are not impacted. The official fix begins with version 9.4.8 as noted in the vendor’s release notes and pull request documentation.

The CVSS v4.0 score of 4.8 indicates moderate severity. The EPSS score is below 1 %, implying that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate high‑privilege credentials to inject the payload, and the attacker must rely on victims visiting the affected page to trigger the client‑side code. No additional system compromise options are disclosed by the vendor or the CVE description.