BraveCMS-2.0 versions before commit 6c56603 store page and article content entered through CKEditor verbatim in the database and render it using Laravel Blade's unescaped output directive {!! !!}. This improper neutralization of input during web page generation (CWE-79) enables editor-role users to inject malicious JavaScript or HTML that executes in every visitor's browser upon page load. The vulnerability is classified as cross-site scripting (XSS) and has a CVSS 3.1 score of 8.7, indicating high severity. The issue was fixed by commit 6c56603, which presumably introduced proper input sanitization or safe output encoding to prevent script execution.

Successful exploitation allows an editor-role user to inject persistent malicious scripts that execute in the browsers of all visitors viewing the affected pages. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability compromises confidentiality and integrity but does not impact availability. There are no reports of active exploitation in the wild.

This vulnerability has been patched in BraveCMS-2.0 by commit 6c56603. Users should upgrade to the patched version including this commit to remediate the issue. Patch status is not explicitly stated beyond the commit reference; therefore, verify the vendor repository or advisory for the exact patched release. No additional mitigation is required if the patch is applied.