This vulnerability involves an authenticated stored XSS in Feehi CMS v2.1.1's Category module. Attackers who have valid credentials can inject crafted payloads into the Name parameter, which are stored and later executed when rendered in the application. This can lead to arbitrary script execution in users' browsers. No CVSS score or remediation details have been published yet.

Successful exploitation could allow an authenticated attacker to execute arbitrary web scripts or HTML in the context of other users, potentially leading to session hijacking, defacement, or other client-side attacks. Since the vulnerability requires authentication, the attack surface is limited to users with access to the vulnerable functionality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Category module to trusted users only and consider applying input validation or output encoding workarounds if feasible.