The ci4ms CMS prior to version 0.31.0.0 contains a stored DOM-based cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-controlled input during web page generation. Multiple input fields in the Page Management functionality accept and store malicious JavaScript payloads without proper sanitization or output encoding. These payloads are later rendered in administrative page lists and public-facing pages, enabling an attacker to execute arbitrary scripts in the context of affected users. The issue is resolved in version 0.31.0.0.

Successful exploitation allows an attacker with at least low privileges to inject persistent JavaScript code that executes in the browsers of administrators and public users. This can lead to session hijacking, data theft, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no user interaction, and partial impact on integrity and availability with high impact on confidentiality.

Upgrade ci4ms to version 0.31.0.0 or later, where this vulnerability has been patched. No other vendor advisories indicate alternative mitigations or that the issue is already mitigated. Patch status is confirmed by the vendor's versioning information.