A stored XSS vulnerability in CI4MS allows unauthorized actors to inject malicious scripts into blog posts, potentially leading to full session compromise for visiting users.

The application fails to properly sanitize user-controlled input within the blog post creation/editing module. This results in stored XSS, where malicious scripts are executed in the browsers of users viewing the compromised content.

With a CVSS score of 9.1, this vulnerability poses a high risk of session hijacking, cookie theft, and unauthorized redirection of users. Successful exploitation could allow an attacker to gain elevated privileges if an administrator views the malicious content, leading to a complete compromise of the CMS.

Immediate Action: Update the CI4MS installation to version 0.31.0.0, which includes necessary input sanitization and output encoding improvements.

Proactive Monitoring: Monitor web application logs for unusual script tags or character sequences in blog post submissions and review browser console errors for potential XSS triggers.

Compensating Controls: Deploy a robust Web Application Firewall (WAF) configured to detect and block common XSS payloads in HTTP request bodies.

Public Exploit Available: Not specified

Stored XSS is a high-impact vulnerability that can be used to bypass client-side security controls. Administrators should expedite the patching process to version 0.31.0.0 to ensure that all user-supplied input is correctly neutralized before rendering.