CI4MS, a CodeIgniter 4-based CMS skeleton, improperly neutralizes user input when adding Posts to navigation menus prior to version 0.31.0.0. Specifically, post-related data selected via the Posts section is stored server-side and rendered without proper output encoding, leading to stored DOM-based cross-site scripting (CWE-79). This vulnerability allows malicious input to be executed in the context of administrative dashboards and public navigation menus. The issue was addressed and patched in version 0.31.0.0.

Exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in unauthorized disclosure of sensitive information, partial integrity loss, and partial availability impact. The vulnerability affects both administrative and public interfaces, increasing the risk of compromise. The CVSS 3.1 score of 9.1 reflects critical severity with network attack vector, low attack complexity, and no user interaction required.

A patch fixing this vulnerability is available in ci4ms version 0.31.0.0. Users should upgrade to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.