An unauthenticated stored Cross-site Scripting vulnerability in the Concrete CMS Community Store plugin allows remote attackers to execute malicious scripts within the sessions of administrative users.

The application fails to perform proper HTML escaping on customer-supplied order fields, such as billing name, email, or phone. This allows an unauthenticated attacker to inject malicious JavaScript that executes when an authorized manager views the order details.

Successful exploitation of this vulnerability poses a significant risk to data integrity and system security. By executing scripts in the context of an administrator session, an attacker could perform unauthorized actions, including the creation of rogue administrative accounts or the exfiltration of sensitive customer and order data. Given the CVSS score of 8.7, this is classified as a high-severity issue that could lead to complete compromise of the store management interface.

Immediate Action: Update the Community Store plugin to version 2.7.8 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review administrative access logs and audit order history for suspicious characters or script tags inserted into billing and contact fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect incoming traffic and block malicious payloads targeting the checkout and order management endpoints.

Public Exploit Available: No

This vulnerability represents a critical risk to the security of the e-commerce backend. IT administrators must prioritize the update to version 2.7.8 to eliminate the injection vector. Given that the impact includes potential account takeover and data theft, immediate patching is required to maintain the confidentiality and integrity of store operations.