Concrete CMS version 9.0 to 9.5.0 contains a stored cross‑site scripting flaw in the Atomik theme page name field. A rogue editor can embed malicious JavaScript that runs in the browser context of any authenticated visitor to the affected account pages. This can lead to session hijacking, credential theft, hijacked account actions, and potentially privilege escalation within the site.

The vulnerability affects Concrete CMS, all releases from 9.0 through 9.5.0 that use the Atomik theme. Users running these versions are at risk when editors can alter page names. The issue is limited to pages rendered with the Atomik theme.

The CVSS score is 2.1, indicating low overall severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires that an attacker has editor or higher privileges and can modify a page name. Because the attack vector is internal and limited to privileged users, the likelihood of exploitation is low. The flaw does not allow remote code execution or affect unauthenticated users, so the attack surface is constrained.