CVE-2026-31351

CVE-2026-31351 is an authenticated stored cross-site scripting vulnerability in Feehi CMS version 2.1.1 that enables attackers to inject malicious scripts through the Title parameter in the creation/editing module. The flaw allows execution of arbitrary web scripts or HTML in the context of affected users' browsers. The vulnerability carries a CVSS score of 4.8 (Medium), requiring high-level privileges and user interaction for successful exploitation. The attack vector is network-based with low complexity, and the impact is limited to low-level confidentiality and integrity compromises without availability impact. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities catalog, and community attention remains minimal with no publicly available exploit code reported. The FAUCET Risk Score of 31.0/100 and EPSS percentile near zero indicate this threat is not a current priority for widespread exploitation.