This vulnerability occurs when user-controlled input in the Methods Management feature of CI4MS is stored without proper sanitation. The attacker can inject JavaScript that is later rendered in administrative and navigation pages, resulting in stored DOM-based XSS. Exploitation allows an attacker to run code in the browser of any administrator, enabling cookie theft, credential compromise, and full account takeover for all roles, as well as arbitrary privilege escalation.

Versions of CI4MS before 0.31.0.0, including 0.30.x and earlier, are affected. The product is the CodeIgniter 4-based CMS skeleton provided by ci4-cms-erp under the product name ci4ms.

The CVSS score of 9.1 indicates critical severity, but the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker exploiting the administrative interface to inject malicious scripts, which then execute in the browsers of other administrators interpreting the stored data.