Stored DOM-Based Cross-Site Scripting in CI4MS CMS from Developer CI4MS

CVE-2026-34566

What is CVE-2026-34566?

The CI4MS CMS, which is built on CodeIgniter 4, contains a vulnerability in its Page Management feature that allows for stored DOM-based cross-site scripting (XSS). Prior to version 0.31.0.0, the application inadequately sanitizes user-controlled inputs during the creation and editing of pages. Malicious users can input JavaScript payloads that get stored on the server. Subsequently, when these inputs are displayed without appropriate output encoding, they can execute harmful scripts in the context of users accessing the administrative and public-facing page views. This issue has been resolved in version 0.31.0.0, and it is crucial for users to update to ensure the security of their applications.

References