An authenticated stored cross‑site scripting vulnerability exists in the Role Management module of Feehi CMS 2.1.1. The flaw allows an attacker to inject arbitrary JavaScript or HTML into the Role Name field, which is later rendered when users view the role data. The malicious code executes in the browsers of any user who accesses the compromised role entry, enabling manipulation of the front‑end or execution of scripts in the victim’s browser context. This vulnerability is identified as CWE‑79.

The only documented affected product is Feehi CMS version 2.1.1. No other products or versions are mentioned. The issue is confined to the Role Management component of that release.

The CVSS base score is 5.4, indicating a moderate severity. The EPSS score is below 1 %, reflecting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an authenticated session with permission to modify roles, it cannot be triggered by an unauthenticated user. An attacker who gains administrative access could inject the payload, affecting every user who subsequently views the role data.