CI4MS, a CodeIgniter 4 CMS skeleton, contains a stored cross‑site scripting flaw in the Google Maps iframe configuration. Administrators edit the cMap field and the input is filtered with strip_tags() and a regex that removes onW+ event handlers. The filter does not guard the srcdoc attribute, so an attacker can inject an iframe element with encoded JavaScript in the srcdoc value. The script runs in the browser of any unauthenticated visitor who views the affected page, allowing cookie theft, page defacement, or further malicious actions.

The vulnerability exists in all CI4MS versions prior to 0.31.4.0. The susceptible component is compInfosPost() handling the cMap field. Only users with administrative privileges can create or alter this field, so an attacker first needs to compromise or abuse admin credentials. Once stored, the payload propagates to every visitor of the rendered page.

The CVSS score of 5.5 indicates moderate severity; EPSS is not available and the flaw is not listed in KEV, suggesting no known widespread exploitation. However, the attack requires admin access—a significant hurdle—yet the impact is serious because injected code runs with the victim’s browser privileges. Organizations running vulnerable CI4MS installations should treat the flaw as high‑priority, especially if unpatched admin accounts or insufficient monitoring for unexpected iframe content exist.