CI4MS, a CodeIgniter 4-based CMS, contains a stored cross‑site scripting flaw caused by unsanitized input when creating or editing blog categories. An attacker can embed malicious JavaScript into a category title; that payload is stored in the database and rendered unsafely on public blog category pages, admin interfaces, and blog post views. The resulting stored XSS can compromise any user who views the affected pages, allowing the attacker to hijack accounts and elevate privileges according to the RBAC configuration. This vulnerability is a classic example of CWE‑79.

The issue affects the CI4MS CMS by ci4‑cms‑erp. All releases prior to version 0.31.0.0 are vulnerable. The affected product is the entire CMS skeleton designed for modular architecture, RBAC authorization, and theme support.

The CVSS score of 10.0 indicates a critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting a malicious category title through the web interface; once stored, the payload will execute in any browser that loads the rendered category page, including administrators, making the risk high if the vulnerability remains unpatched.