CI4MS is a CodeIgniter 4-based content management system skeleton that suffered a stored XSS flaw. Prior to version 0.31.9.0 the Pages backend module registers an html_purify validation rule for language‑keyed page content but mistakenly stores the raw, un‑purified POST value in the database. The public page renderer emits $pageInfo->content without escaping, allowing an authenticated user to inject arbitrary scripts that are executed for every public visitor—including administrators—when the page is viewed. Because affected pages can be promoted as the site home page, a malicious payload can be served at the root path "/", exposing all site visitors to the impact.

The issue appears in the CI4MS content management system, specifically its Pages backend module, when running any version prior to 0.31.9.0. All deployments of CI4MS completing 0.31.9.0 or later are unaffected.

This vulnerability has a CVSS score of 8.7, indicating high severity. Because the likely attack vector requires the attacker to first access the administrative area to insert malicious content, it is not fully remote. The EPSS score is reported as < 1%, indicating a very low but non‑zero probability that the vulnerability is exploited in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Once an attacker injects harmful code, every subsequent visitor of the compromised page will be exposed to the impact, including administrators who may use the site’s home page as a front door. The risk is elevated for sites that use promoted pages as the site home page.