CI4MS, a CodeIgniter 4-based CMS skeleton, suffers from a stored DOM-based XSS vulnerability (CWE-79) in versions before 0.31.0.0. Multiple input fields in the Methods Management feature accept attacker-controlled JavaScript payloads that are stored server-side without sanitization or output encoding. These payloads are then rendered directly into administrative and global navigation interfaces without proper encoding, enabling stored XSS attacks. This issue was addressed and patched in version 0.31.0.0.

Successful exploitation allows an attacker with at least low privileges to inject malicious JavaScript that is stored and executed in the context of administrative users, potentially leading to session hijacking, privilege escalation, or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and scope change, with high confidentiality impact, low integrity impact, and low availability impact.

Upgrade CI4MS to version 0.31.0.0 or later, where the vulnerability has been patched. Applying this official fix will ensure proper sanitization and encoding of user input in the Methods Management functionality, preventing stored DOM-based XSS attacks.