Xibo CMS prior to version 4.4.2 contains a vulnerability chain that combines stored XSS and an iframe sandbox escape. By using the Data Connector feature in a DataSet, an authenticated user with DataSet permissions can inject a malicious script that breaks out of the iframe sandbox, enabling the payload to run with the context of the CMS and access sensitive information or perform malicious actions. This flaw is an example of unvalidated user input leading to XSS (CWE‑79) and improper output encoding (CWE‑116), and the ability to bypass sandbox restrictions (CWE‑346).

Affected systems are installations of the Xibo Signage CMS with versions older than 4.4.2. Privileged users who have been granted the ability to add new DataSets via the "Add DataSet" button are able to exploit the flaw. Non‑admin users normally do not receive this permission unless it has been explicitly granted.

The CVSS score of 7.6 classifies this vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the CMS with DataSet creation privileges; the attacker can inject a payload through the Data Connector interface, escape the sandbox and run arbitrary JavaScript. While the exact probability of exploitation is unknown, the high impact and the need for privileged access make the risk significant for organisations that have granted DataSet permissions to many users.