CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the "Pages" backend module registers the "html_purify" validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages ("Home::index()" → "app/Views/templates/default/pages.php") emits "$pageInfo->content" without "esc()", yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at "/" and reach every visitor of the site. Version 0.31.9.0 patches the issue.