# CVE-2026-125340: Winter CMS reflected XSS in Table widget search parameter

Source: https://junglewise.ai/threats/cve-2026-125340-winter-cms-is-a-content-management-system-built-on-the-laravel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125340 · Severity: medium · CVSS 4.5 · Published 2026-11-10

Winter CMS is a content management system that allows administrators to publish and manage web content via a backend dashboard. The backend Table widget fails to properly encode user input in search parameters, allowing an attacker to inject malicious scripts that execute in a victim's browser with their authenticated permissions. An authenticated user viewing a crafted link could have their CSRF token stolen, and users with editor permissions could face further exploitation leading to code execution on the server.

Technologies: [Winter CMS](https://junglewise.ai/threats/technologies/winter-cms). Vendors: [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-125340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125340 being exploited in the wild.

**How severe is CVE-2026-125340?** Medium severity, with a CVSS score of 4.5, published 10 November 2026.

**Which products and versions are affected?** Winter CMS 1.0.420 to 1.2.13.

**Is there a fix for CVE-2026-125340?** Yes: fixed in 1.2.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125340 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125340?** Check whether you run Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.14

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the backend Table widget partial (_table.php) that emits the search query parameter without HTML encoding inside a script template. An attacker can inject a script-closing sequence in the URL to break out of the template context and inject arbitrary backend markup, bypassing the searching: false configuration. The attack requires an unauthenticated attacker to socially engineer an authorized backend user into following a malicious link; scripts execute with the victim's credentials and can read CSRF tokens and issue requests with the victim's permissions.

## Affected products

- Winter CMS Winter CMS 1.0.420 to 1.2.13

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14](https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14)
- [https://github.com/wintercms/winter/releases/tag/v1.2.14](https://github.com/wintercms/winter/releases/tag/v1.2.14)

## Related threats

- [Winter CMS MyAccount controller information disclosure](https://junglewise.ai/threats/cve-2026-126061-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS CSRF via unvalidated backend handler invocation](https://junglewise.ai/threats/cve-2026-125339-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS stored XSS in backend brand and editor settings](https://junglewise.ai/threats/cve-2026-125338-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)
- [Winter CMS broken access control in Cms Controllers Index](https://junglewise.ai/threats/cve-2026-32639-winter-cms-broken-access-control-in-cms-controllers-index)