Stored XSS results from the application storing CKEditor content without escaping and later rendering it using Laravel Blade's unescaped output directive {!! !!}. Consequently, any JavaScript or HTML injected by a user with editorial privileges is permanently persisted and executed in every visitor's browser when the page loads. This flaw enables client‑side code execution with the privileges of the logged‑in user and can be used to steal session cookies, modify page content, or redirect users to malicious sites.

The flaw affects the open‑source content management system BraveCMS version 2.0, developed by Ajax30. The vulnerability existed prior to commit 6c56603; any installation of BraveCMS 2.0 before this commit is vulnerable.

The CVSS score of 8.7 indicates a high‑severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. A likely attack path requires an attacker to possess editorial privileges to inject malicious script via the CKEditor interface; once injected, the payload is stored and served to all visitors. Because the exploit leverages legitimate content editing, the barrier to exploitation is low for attackers who control or compromise an editorial account. No additional external attack vector is needed beyond the editor role.