The vulnerability in ci4ms (CVE-2026-45270) is a stored cross-site scripting (CWE-79) flaw in the Pages backend module of the CMS. Although the module registers an html_purify validation rule, it stores the raw POST data without purification. The public page renderer outputs this unescaped content, enabling stored XSS that executes in the browsers of all visitors, including admins. This can be especially impactful if the compromised page is promoted to the site home page, exposing the payload at the root URL. The issue affects versions prior to 0.31.9.0, which includes all releases before that version. The vulnerability has a CVSS 3.1 score of 8.7, indicating high severity. No official remediation level or patch link is provided in the data, but version 0.31.9.0 is stated as the fixed version.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected site for all visitors, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions within the user's browser. Because the vulnerable page can be set as the home page, the attack surface includes every visitor to the site, increasing the potential impact. There is no indication of denial of service or direct system compromise from this vulnerability.

Upgrade ci4ms to version 0.31.9.0 or later, which patches the stored XSS vulnerability by properly handling and escaping page content before rendering. Since no official patch link or temporary fix is provided, applying this version upgrade is the recommended remediation. Until upgraded, avoid promoting untrusted pages to the home page and consider manual content sanitization as a temporary measure.