Concrete CMS versions prior to 9.4.8 allow a rogue administrator to inject arbitrary HTML and JavaScript through the Switch Language block, resulting in stored cross‑site scripting. The attacker can embed malicious scripts that persist in the site content and execute in the browsers of any authenticated user who views the affected pages, potentially compromising account sessions, defacing content, or exfiltrating sensitive information.

Affects Concrete CMS installations running any version older than 9.4.8. Users should verify that their CMS instance is below this release before applying remediation.

The vulnerability receives a CVSS v4.0 score of 4.8, indicating moderate severity, and an EPSS score of less than 1%, signaling a low probability of exploitation in the wild. The defect is not included in the CISA KEV catalog. Exploitation requires elevated privileged access, as the attacker must be a malicious administrator controlling the Switch Language block.