A stored cross-site scripting (XSS) vulnerability exists in laravel-7-blog-cms "page" field

[scofield1920]

Description:
Cross-site scripting (XSS) vulnerability in laravel-7-blog-cms might allow remote attackers (users) to inject arbitrary web script or HTML via the source editor, which will result in Stored XSS when an Administrator tries to edit the post.

Vulnerability Type: Stored XSS

Attack Vectors:

Login as user on laravel-7-blog-cms
visit /admin/pages
click Add New
select source code
write in details:<img src="x" onerror="alert(Xss!!)" style="">
click create
and then visite index, and visite the page we created

Attack Impact:
This could be used to perform actions against the administrators (or any user editing that post) and could potentially lead to hijacking the user’s session/token. This could happen by users navigating to the attacker’s post on their own, or by the attacker somehow persuading the victim to navigate to the post.