Authenticated users can save malicious scripts through the Group, Category and Description fields in the Permissions module of Feehi CMS 2.1.1. These payloads are stored and later rendered when other users view the permissions data, allowing attackers to execute arbitrary client‑side code. This stored XSS (CWE‑79) can lead to session hijacking, defacement or phishing attempts, compromising confidentiality, integrity or availability of the application’s user interface.

Version 2.1.1 of Feehi CMS, specifically its Permissions module. No other vendors or products are listed as affected.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability requires authenticated access, so an attacker must know valid credentials. It is not listed in the CISA KEV catalog. The primary attack vector is via normal CMS operations by an authenticated user submitting a crafted payload to the affected fields.