Cloudanix VulnDB

CVE-2026-45270

High · 8.7

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CVSS

8.7

EPSS

0.4%

Published

May 18, 2026

CISA due date

—

The record

The `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities