Is CVE-2026-125340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125340 being exploited in the wild.

How severe is CVE-2026-125340?

Medium severity, with a CVSS score of 4.5, published 10 November 2026.

Is there a fix for CVE-2026-125340?

Yes: fixed in 1.2.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125340 attacked?

It is attacked over the network.

Am I affected by CVE-2026-125340?

Check whether you run Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125340: Winter CMS reflected XSS in Table widget search parameter

CVE-2026-125340 · Severity: medium · CVSS 4.5 · Published 2026-11-10

Winter CMS is a content management system that allows administrators to publish and manage web content via a backend dashboard. The backend Table widget fails to properly encode user input in search parameters, allowing an attacker to inject malicious scripts that execute in a victim's browser with their authenticated permissions. An authenticated user viewing a crafted link could have their CSRF token stolen, and users with editor permissions could face further exploitation leading to code execution on the server.

Technologies: Winter CMS. Vendors: Winter CMS.

Quick answers

Is CVE-2026-125340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125340 being exploited in the wild.
How severe is CVE-2026-125340?: Medium severity, with a CVSS score of 4.5, published 10 November 2026.
Which products and versions are affected?: Winter CMS 1.0.420 to 1.2.13.
Is there a fix for CVE-2026-125340?: Yes: fixed in 1.2.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125340 attacked?: It is attacked over the network.
Am I affected by CVE-2026-125340?: Check whether you run Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.14

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the backend Table widget partial (_table.php) that emits the search query parameter without HTML encoding inside a script template. An attacker can inject a script-closing sequence in the URL to break out of the template context and inject arbitrary backend markup, bypassing the searching: false configuration. The attack requires an unauthenticated attacker to socially engineer an authorized backend user into following a malicious link; scripts execute with the victim's credentials and can read CSRF tokens and issue requests with the victim's permissions.

Affected products

Winter CMS Winter CMS 1.0.420 to 1.2.13

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.