A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS version 17.9.1. The flaw occurs in the message system where unsanitized user-submitted message content is stored and later rendered in another user's Inbox without proper encoding, allowing attacker-controlled scripts to execute in the recipient's browser context.