CI4MS is a CodeIgniter 4 based CMS skeleton that uses page management functionality. Prior to release 0.31.0.0 the application fails to properly sanitize user input in multiple fields that are stored server‑side. These values are later rendered without output encoding, allowing an attacker to embed and persist malicious JavaScript that runs in the context of an administrator or any visitor to a public page. The resulting stored DOM‑based XSS can lead to full account takeover, privilege escalation, or theft of session cookies, as classified by CWE‑79.

The vulnerability affects all CI4MS installations running versions older than 0.31.0.0 from the vendor ci4‑cms‑erp. The official fix has been applied in release 0.31.0.0, which removes the unsanitized input store and applies proper output encoding. No other versions are documented, so any earlier release is considered vulnerable.

The CVSS score of 9.1 indicates a high severity attack that could compromise confidentiality, integrity, and availability of the CMS account. The EPSS score of under 1 % suggests low current exploit probability, and the issue is not listed in CISA KEV, implying no known public exploits. The likely attack vector is remote web‑based input through the page editing interface, where an attacker with permissions to create or edit pages can inject payloads. Successful exploitation would give access to administrative functionality and allow further privilege escalation.