Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-41524Ajax30/BraveCMS-2.0: Stored XSS in Page / Article Content

High 8.7

In plain English

A high-severity cross-site scripting in BraveCMS-2.0 from Ajax30. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

Affected products (as reported)

Vendor	Product	Versions
Ajax30	BraveCMS-2.0	< 6c5660373cf5f0ca9181603280427aca46ef11ea

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-xj46-722x-6433 x_refsource_CONFIRM
https://github.com/Ajax30/BraveCMS-2.0/commit/6c5660373cf5f0ca9181603280427aca46ef11ea x_refsource_MISC