CVE-2026-34558

CVE-2026-34558 is a critical Stored DOM-Based Cross-Site Scripting (XSS) vulnerability affecting CI4MS (a CodeIgniter 4-based CMS skeleton) prior to version 0.31.0.0. This flaw allows an authenticated attacker with low privileges to inject unsanitized JavaScript payloads into the Methods Management functionality. These malicious payloads are stored server-side and execute when administrative interfaces or global navigation components are rendered, leading to a CVSS score of 9.1. The vulnerability is network-exploitable with low attack complexity, potentially resulting in high confidentiality impact, including full account takeover and privilege escalation. While there is no evidence of active exploitation or public exploit code, the issue has garnered some community discussion highlighting its severe implications.