CVE-2023-28476: Concretecms Concrete CMS

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

Affected products

• Concretecms Concrete CMS: before 9.2.0 (fixed in 9.2.0)

Published 2023-04-28. Last modified 2026-06-17.