CI4MS is a CodeIgniter‑based CMS skeleton. Versions prior to 0.31.0.0 fail to sanitize user input when adding Pages to navigation menus. The stored page data is later rendered without proper output encoding, resulting in stored DOM‑based cross‑site scripting. This weakness can allow an attacker to inject arbitrary JavaScript that is executed when the menu is displayed.

All releases of ci4‑ms before 0.31.0.0 are affected. The issue can surface in both administrative interfaces and public‑facing navigation menus for any user who has access to the CMS.

The CVSS score is 9.1 and the EPSS score is less than 1%. The vulnerability is not listed in the KEV catalog. The likely attack vector is the web application, where an attacker with access to the Menu Management feature can insert malicious content. Based on the description, it is inferred that the injected code could execute in the context of any user who subsequently views the vulnerable menu, potentially leading to unauthorized actions or credential theft.