CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0…

CI4MS, a CodeIgniter 4-based CMS skeleton, contains a stored DOM-based cross-site scripting vulnerability in versions prior to 0.31.0.0. The vulnerability occurs in the Menu Management functionality where user-controlled input is not properly sanitized when adding Pages to navigation menus. Page-related data is stored server-side and rendered without proper output encoding, allowing stored XSS payloads to execute in both administrative interfaces and public-facing navigation menus. The issue has been patched in version 0.31.0.0.