A flaw in CI4MS’s custom `html_purify` validation rule prevented proper sanitization of blog post bodies. The rule expects to modify its argument in place, but CodeIgniter 4’s validator supplies a local copy, so the sanitized text is silently discarded. Because the Blog controller writes `$lanData['content']` straight into the database and the public template echoes that field without escaping, any HTML or JavaScript stored in a post is rendered unchanged and executed in the browser of every visitor, including the superadmin when previewing or editing. This stored cross‑site scripting (CWE‑79) can be used to steal session cookies, deface the site, or otherwise compromise client‑side confidentiality and integrity.

The affected product is CI4MS, a CodeIgniter 4 based CMS skeleton produced by ci4-cms-erp. All installations using a version earlier than 0.31.9.0 are vulnerable. The patch is included in the 0.31.9.0 release and later versions.

The CVSS score of 5.4 classifies the issue as moderate severity, while the EPSS score of < 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker needs access to the blog post editor or a user with posting privileges to insert malicious content, after which any visitor to the site will execute the payload in their browser. The impact is limited to client‑side script execution, but it can lead to credential theft, session hijacking, or data exfiltration.