Is CVE-2026-32257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32257 being exploited in the wild.

How severe is CVE-2026-32257?

High severity, with a CVSS score of 8.1, published 26 August 2026.

Which products and versions are affected?

winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.

Is there a fix for CVE-2026-32257?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32257 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-32257?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32257: Winter CMS stored XSS in Brand Settings custom styles

Q: Is there a fix for CVE-2026-32257?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32257 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-32257?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32257 · Severity: high · CVSS 8.1 · Published 2026-08-26

Winter CMS, a platform used for building and managing websites, contains a vulnerability that allows administrative users to inject malicious scripts into the management interface. An attacker with specific branding permissions could use this to execute code in the browsers of other administrators, potentially leading to unauthorized data access or account takeover. This issue is resolved in version 1.2.13.

Technologies: winter/wn-backend-module (Packagist), Winter CMS. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-32257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32257 being exploited in the wild.
How severe is CVE-2026-32257?: High severity, with a CVSS score of 8.1, published 26 August 2026.
Which products and versions are affected?: winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.
Is there a fix for CVE-2026-32257?: Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32257 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-32257?: Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later
```
composer require winter/wn-backend-module:^1.2.13
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Winter CMS within the 'Customize Backend' and 'Markup Styles' settings. The application uses a LESS CSS parser to compile user-provided styles but failed to sanitize the compiled output before rendering it on backend pages. An attacker with 'backend.manage_branding' or 'backend.manage_editor' permissions can inject malicious payloads that execute in the context of other backend users. The vulnerability is addressed in version 1.2.13 by implementing proper sanitization of the compiled CSS output.

Affected products

Winter CMS Winter CMS <= 1.2.12

Identifiers

CVE-2026-32257
GHSA-v7cf-8gh9-gxmj

Timeline

2026-08-07: disclosed: Initial disclosure by maintainers
2026-08-12: advisory: GitHub Advisory published
2026-08-12: patched: Patch confirmed in version 1.2.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.