Concrete CMS versions 9.5.0 and earlier allow an editor‑level user to submit an unsanitized height value to a controller. The value is stored directly and rendered in the page, enabling the attacker to embed arbitrary JavaScript. The injected script executes in every visitor's browser in the same session as the site, providing a vector for session hijacking, credential theft, or other malicious client‑side actions.

Concrete CMS installations running 9.5.0 or earlier, that have not applied the official height‑parameter validation fix, are vulnerable. Any user granted editor or equivalent editing permissions can trigger the flaw by adding content through the CMS interface.

The CVSS v4.0 score of 7.3 indicates moderate‑to‑high severity. EPSS is not available and the issue is not listed in CISA KEV, so there is no evidence of widespread exploitation yet. Exploitation requires only editor privileges, which are commonly assigned, and can be performed through the standard web interface without further escalation. The impact remains client side, but the ability to hijack sessions or steal credentials can have serious consequences for users of the site.