The vulnerability allows persistent cross‑site scripting because unsanitized HTML entered into Kirby's list field is stored and later rendered on the website. Kirby's list field stores formatted content as HTML, and the server does not sanitize this field on save; only client‑side checks in the Panel exist. As a result an attacker can embed malicious JavaScript into the list, which will execute in the browsers of site visitors and logged‑in users who view the affected pages. This flaw corresponds to CWE‑79.

The issue affects the Kirby content‑management system. Versions before 4.9.1 and before 5.4.1 are vulnerable; those releases include the list field that stores formatted HTML without server‑side sanitization.

The CVSS score of 8.5 indicates high severity, while the EPSS score below 1 % shows a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Attackers can exploit it by sending crafted content through Kirby's API, bypassing the Panel's client‑side checks. Based on the description, it is inferred that a remote attacker able to submit requests to the API can inject malicious markup, resulting in persistent script injection that runs whenever the list field is displayed and affecting both visitors and logged‑in users.