Authenticated browser script execution via interrupt notifications

Stored XSS in Xibo CMS before 4.4.1 allows remote authenticated users to execute JavaScript in targeted users' browsers through notifications. The notification rendering path persists an attacker-controlled body without neutralizing it, and an interrupt notification renders that stored content automatically when a targeted user logs in. The attacker needs Notification Centre access and Add Notification permission, privileges not granted to non-admins by default; successful execution affects the targeted browser's security context.