CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0…

CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 0.31.0.0. The vulnerability occurs when the application fails to properly sanitize user-controlled input during blog tag creation or editing. Attackers can inject malicious JavaScript payloads into the tag name field, which are stored server-side and later rendered unsafely across public tag pages and administrative interfaces without proper output encoding. This allows for stored XSS attacks that can affect both public users and administrators. The issue has been patched in version 0.31.0.0.