The vulnerability occurs in the Category module of Feehi CMS 2.1.1. An attacker who can authenticate to the administration interface can submit a specially crafted value for the Name field. The input is stored and later rendered as part of the web page without proper encoding, allowing execution of arbitrary JavaScript or injection of HTML. This can be used to deface pages, steal session cookies, or perform phishing attacks against users who view the affected page.

The affected product is Feehi CMS, version 2.1.1. The Category module of this CMS is susceptible to the stored XSS. Administrators using this version should verify whether they are running the identified version or a later release with the fix.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1 %, reflecting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to create or edit a category, so a legitimate user account or a compromised credential is necessary. Once an attacker injects a payload, any visitor to the page that displays the category name can run the code, potentially leading to data theft or defacement.