The ci4ms CMS prior to version 0.31.0.0 suffers from a CWE-79 stored cross-site scripting vulnerability due to improper neutralization of user input in the Categories section during blog post creation or editing. Malicious JavaScript injected into category content is stored on the server and later rendered without proper output encoding, enabling attackers to execute scripts in the context of users viewing the affected categories. This vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity, with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability. The vulnerability is fixed in version 0.31.0.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users viewing blog post categories, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Upgrade ci4ms to version 0.31.0.0 or later, where this vulnerability has been patched. No other mitigation is required as the fix addresses the root cause by properly sanitizing and encoding user input in the Categories section.