An authenticated stored cross‑site scripting (CWE‑79) flaw in Feehi CMS version 2.1.1 allows a logged‑in user to inject malicious JavaScript or HTML into the Page Sign parameter. When other users view the affected page, the injected code executes in their browsers, giving the attacker the ability to run arbitrary scripts. The described capability to execute web scripts, coupled with standard XSS attack patterns, implies that an attacker could hijack user sessions or steal cookies, although these specific outcomes are not explicitly detailed in the CVE.

Feehi CMS version 2.1.1 is the affected product. No other versions or vendors are listed in the CNA data.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score below 1 % suggests a low likelihood of exploitation. The vulnerability requires a legitimate CMS account to inject the payload, so the primary attack vector is authenticated access via the administration interface. Although the flaw is not published in CISA’s KEV catalog, the combination of client‑side impact and moderate severity warrants prompt remediation.