CI4MS, a CodeIgniter‑based CMS framework, stores JavaScript payloads submitted through the Methods Management panel without sanitization or encoding. The stored script is later injected into administrative pages and global navigation, causing a stored, DOM‑based cross‑site scripting vulnerability. The flaw allows an attacker to execute code in the session of any user who views the affected content, potentially leading to complete administrative compromise and privilege escalation.

All CI4MS releases earlier than 0.31.0.0 are susceptible. The weakness resides in the Methods Management component of the CMS, where users can create or modify application methods and pages via web forms.

The base CVSS score of 9.1 reflects a high‑severity condition with no network or authentication requirements beyond normal CMS usage. The exploit is straightforward: craft a malicious script, submit it through the management interface, and trigger its execution when an administrator accesses the affected view. Although EPSS data is lacking and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, the high CVSS and low attack complexity make it likely to be abused if unpatched.