Kirby CMS improperly neutralizes input during web page generation in its list field prior to versions 4.9.1 and 5.4.1. The list field stores content as HTML and cannot escape special characters without losing formatting. Sanitization was only enforced client-side in the Panel, while the server accepted unsanitized input via the API. This allows attackers to inject malicious HTML that is persistently stored and executed in site visitors' and logged-in users' browsers, resulting in a persistent cross-site scripting (XSS) vulnerability. The vulnerability is addressed by server-side sanitization fixes introduced in versions 4.9.1 and 5.4.1.

An attacker can inject malicious HTML content into the Kirby CMS list field by bypassing client-side controls and sending crafted input directly to the API. This malicious content is stored persistently and rendered on the frontend, leading to execution of arbitrary scripts in the browsers of site visitors and authenticated users. This can result in session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 8.5 (high severity), reflecting network attack vector, low complexity, no privileges required, partial user interaction, and high impact on confidentiality and integrity.

This vulnerability has been fixed in Kirby CMS versions 4.9.1 and 5.4.1. Users should upgrade to at least these versions to ensure server-side sanitization of the list field content. No other mitigations are specified. Patch status is confirmed by the vendor advisory stating the fix in these versions.