A flaw in CI4MS allows an administrator with blacklist privileges to store arbitrary JavaScript in a blacklist note that is later rendered unescaped in a data‑note attribute of the user management page. This stored cross‑site scripting can be executed in the browser of any other admin who views the affected page, potentially enabling session hijacking, credential theft, or malicious content injection.

The vulnerability is present in CI4MS CMS skeleton releases before version 0.31.4.0, specifically in the UserController::ajax_blackList_post() method where blacklist notes are stored without sanitization. All installations of the affected release that have admin users capable of assigning or modifying blacklist entries may be affected.

The CVSS score of 4.8 indicates a medium severity level. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, suggesting that there are currently no publicly known widespread exploits. However, any attacker who can log into the admin panel with blacklist privileges can abuse the flaw, so the risk remains tangible until the fix is applied. The issue is resolvable by upgrading to 0.31.4.0 or later and is not inherently exploitable from external sources without administrative access.