Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| concrete5/concrete5(Packagist) | 0 | 9.1.0 | N/A |
CVSS Metrics
