A stored Cross‑Site Scripting flaw exists in Xibo CMS versions prior to 4.4.1. An authenticated user who can create notifications can inject arbitrary JavaScript into the notification body. When the notification is marked as "interrupt," the payload automatically runs in the browser of any user that logs in, without requiring any additional action from that user. This weakness is described by CWE‑79.

The vulnerability affects the Xibo CMS platform provided by xibosignage. Any installation running a version older than 4.4.1 is susceptible. The change introduces a fix in release 4.4.1; all earlier releases remain vulnerable.

The CVSS v3.1 score is 6.4, indicating a medium threat level. The EPSS score of less than 1% suggests that exploitation is rare, and the vulnerability is not listed in CISA’s KEV catalog. However, the exploit requires an authenticated account with notification‑creation privileges, a role normally reserved for administrators. Once executed, the JavaScript runs within the victim’s browser context during login, which can be used by an attacker to perform malicious client‑side actions.