In CI4MS, a CodeIgniter 4‑based CMS skeleton, page content is stored in the database without applying the html_purify validation rule in the Pages module before version 0.31.4.0. When a page is displayed, the content is echoed directly as raw HTML in the public frontend. An authenticated administrator with page‑editing privileges can therefore embed arbitrary JavaScript into the page. When visitors load the page, the injected script executes in their browsers.

Vulnerable installations of the ci4ms CMS from ci4‑cms‑erp that use the Pages module and are running any release prior to 0.31.4.0 are affected. Administrators who have the ability to edit pages are the only users able to create the vulnerable content.

The CVSS score of 5.5 indicates moderate severity, reflecting that exploitation requires authenticated access and leads to client‑side impact only. EPSS data is unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that exploitation is either not yet documented or limited. The likely attack vector is inferred to be an authenticated administrator with page‑editing privileges; after injecting the script, the malicious code is served to all public visitors. The risk is mitigated by upgrading to version 0.31.4.0 or newer, or by removing page‑editing rights from administrators if an upgrade cannot be performed immediately.