Concrete CMS versions below 9.4.8 render search results without proper HTML encoding, enabling authenticated rogue administrators to insert malicious JavaScript into page names. The embedded script executes in the browsers of users who view those search results, providing a stored XSS vector. The weakness is classified as CWE‑79.

The vulnerability affects installations of Concrete CMS running any version older than 9.4.8; newer releases are not impacted.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires a high‑privilege administrator account, but the CVSS vector indicates the attacker can act remotely, so the attack vector is network rather than strictly internal. Overall the risk remains moderate, but the low exploitation likelihood should not induce complacency, especially for organizations with valuable content.