# CVE-2026-32258: Winter CMS stored XSS in Editor Settings custom styles

Source: https://junglewise.ai/threats/cve-2026-32258-winter-cms-stored-xss-in-editor-settings-custom-styles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-32258 · Severity: high · CVSS 8.1 · Published 2026-08-26

Winter CMS, a platform used for building and managing websites, contains a vulnerability where administrative users can inject malicious scripts into the system's editor settings. If exploited, these scripts could run in the browsers of other administrators, potentially leading to unauthorized actions or data theft. This issue requires the attacker to already have high-level administrative permissions within the CMS.

Technologies: [winter/wn-backend-module (Packagist)](https://junglewise.ai/threats/technologies/winter-wn-backend-module), [Winter CMS Backend Module](https://junglewise.ai/threats/technologies/backend-module). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-32258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32258 being exploited in the wild.

**How severe is CVE-2026-32258?** High severity, with a CVSS score of 8.1, published 26 August 2026.

**Which products and versions are affected?** winter/wn-backend-module (Packagist) >= 1.2.10, < 1.2.13, ECOSYSTEM:introduced=1.2.10,fixed=1.2.13; Winter CMS Backend Module >= 1.2.10, < 1.2.13.

**Is there a fix for CVE-2026-32258?** Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32258 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32258?** Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later

  ```sh
  composer require winter/wn-backend-module:^1.2.13
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Winter CMS within the 'Markup Styles' section of the Editor Settings. Authenticated backend users with the 'backend.manage_editor' permission can input custom LESS CSS styles that are compiled and rendered on every backend page without proper sanitization. The root cause is the lack of output encoding in the renderCss() method. An attacker with administrative privileges can leverage this to execute arbitrary JavaScript in the context of other backend users. The issue is fixed in version 1.2.13 by implementing strip_tags() on the compiled CSS output.

## Affected products

- Winter CMS wn-backend-module >= 1.2.10, < 1.2.13

## Identifiers

- CVE-2026-32258
- GHSA-vgp4-2fc4-qff2

## Timeline

- 2026-08-07: disclosed: Initial disclosure by maintainers
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fix released in version 1.2.13

## References

- [https://api.github.com/users/skyhex19](https://api.github.com/users/skyhex19)
- [https://github.com/skyhex19](https://github.com/skyhex19)
- [https://api.github.com/users/skyhex19/gists%7B/gist_id%7D](https://api.github.com/users/skyhex19/gists%7B/gist_id%7D)
- [https://api.github.com/users/skyhex19/repos](https://api.github.com/users/skyhex19/repos)
- [https://avatars.githubusercontent.com/u/102454417?v=4](https://avatars.githubusercontent.com/u/102454417?v=4)
- [https://api.github.com/users/skyhex19/events%7B/privacy%7D](https://api.github.com/users/skyhex19/events%7B/privacy%7D)

## Related threats

- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)
- [Winter CMS FileUpload widget IDOR in attachment metadata](https://junglewise.ai/threats/cve-2026-54256-winter-cms-fileupload-widget-idor-in-attachment-metadata)
- [Winter CMS SQL injection in Backend Filter Widget numberrange scope](https://junglewise.ai/threats/cve-2026-32593-winter-cms-sql-injection-in-backend-filter-widget-numberrange)
- [Winter CMS authorization bypass in Users controller](https://junglewise.ai/threats/cve-2026-35445-winter-cms-authorization-bypass-in-users-controller)
- [Winter CMS stored XSS in Brand Settings custom styles](https://junglewise.ai/threats/cve-2026-32257-winter-cms-stored-xss-in-brand-settings-custom-styles)