CI4MS suffers from a critical stored DOM-based Cross-Site Scripting (XSS) vulnerability via unsanitized user profile name updates. Attackers can inject malicious JavaScript payloads into profile name fields, which are stored server-side and rendered unsafely across multiple application views, including administrative interfaces. This allows execution of arbitrary scripts in the context of users viewing these profiles, notably administrators, enabling privilege escalation and full admin account takeover. The vulnerability affects all versions prior to 31.0.0.0 and has a CVSS score of 9.0, indicating critical severity. A patch is available in version 31.0.0.0. Recommended mitigations include eliminating unsafe DOM sinks, applying output encoding, enforcing server-side input sanitization, and adopting defense-in-depth strategies such as Content Security Policy headers.