CVE-2026-32258: Winter CMS stored XSS in Editor Settings custom styles

Executive brief

Winter CMS, a platform used for building and managing websites, contains a vulnerability where administrative users can inject malicious scripts into the system's editor settings. If exploited, these scripts could run in the browsers of other administrators, potentially leading to unauthorized actions or data theft. This issue requires the attacker to already have high-level administrative permissions within the CMS.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Winter CMS within the 'Markup Styles' section of the Editor Settings. Authenticated backend users with the 'backend.manage_editor' permission can input custom LESS CSS styles that are compiled and rendered on every backend page without proper sanitization. The root cause is the lack of output encoding in the renderCss() method. An attacker with administrative privileges can leverage this to execute arbitrary JavaScript in the context of other backend users. The issue is fixed in version 1.2.13 by implementing strip_tags() on the compiled CSS output.

Affected products

• Winter CMS wn-backend-module >= 1.2.10, < 1.2.13

Timeline

• 2026-08-07: disclosed: Initial disclosure by maintainers
• 2026-08-12: advisory: GitHub Advisory published
• 2026-08-12: patched: Fix released in version 1.2.13

References

• https://api.github.com/users/skyhex19
• https://github.com/skyhex19
• https://api.github.com/users/skyhex19/gists%7B/gist_id%7D
• https://api.github.com/users/skyhex19/repos
• https://avatars.githubusercontent.com/u/102454417?v=4
• https://api.github.com/users/skyhex19/events%7B/privacy%7D