The flaw originates from an oversight in sanitizing user input when creating or editing blog post categories in CI4MS, a CodeIgniter 4‑based CMS skeleton. A malicious script can be embedded into category content, stored by the server, and later rendered without proper output encoding when categories are viewed. This stored XSS can steal authentication cookies, hijack sessions, and elevate privileges, permitting an attacker to take full control of any user account regardless of role assignment.

The affected system is the CI4MS application. All releases prior to version 0.31.0.0 are vulnerable. Version 0.31.0.0 introduces the necessary input sanitization and resolves the issue.

The vulnerability carries a CVSS score of 9.1, indicating critically high severity. EPSS is below 1 %, suggesting that active exploitation is currently low in frequency. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have write access to the categories section, which typically means having any authenticated account. Once injected, the stored payload is executed in the browser of any visitor viewing the affected categories, providing a path to full account takeover.