An authenticated stored cross‑site scripting flaw exists within Feehi CMS version 2.1.1. Attackers with access to the content creation or editing module can insert a malicious payload into the content field, which is then saved and rendered for all users who view the page. The stored nature of the exploit permits execution of arbitrary JavaScript or HTML inside the victim’s browser, potentially compromising session data, defacing the site, or redirecting traffic.

The impact is limited to installations of Feehi CMS version 2.1.1 that provide authenticated users with the ability to create or edit content. No other vendors or product versions are currently known to be affected.

The CVSS score of 5.4 indicates a moderate severity level, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present. Because the flaw requires authenticated access, only accounts with content‑editing privileges can launch this attack; however, many deployments grant such privileges to regular users. Once an attacker injects the payload, it persists in the database and will be delivered to every visitor who opens the affected page, leading to lasting damage if not addressed.