Winter CMS: Stored XSS via cached Brand and Editor Settings custom CSS
Summary
Winter CMS stores custom CSS from the Brand Settings and Editor Settings in a cache and only sanitises the output on a cache miss. Users with the backend.manage_branding or backend.manage_editor permission can therefore inject script markup that is served unsanitised from the cache and executed when backend pages render the styles, including unauthenticated sign-in and password reset pages. The attack requires a backend account with one of these permissions and user interaction by a victim.
Affected
- Winter CMS (wintercms/winter, Composer package winter/wn-backend-module) before 1.2.14
- Affected versions: all versions below 1.2.14
Fixed in
- Fixed in version 1.2.14 (released 19 August 2026)
Workaround
- Apply the fix commit c95d780ab54f3a3f74a94ae1667bf12b3c549d5d manually if an upgrade is not possible
- Clear the application cache to remove an existing poisoned entry; it is rebuilt on the next backend render unless the patch is in place
- Grant backend.manage_branding and backend.manage_editor only to trusted administrators and developers
Exploitation
- Not listed in CISA KEV.
- Not known to be exploited as of 10 November 2026 (OffSeq).
- No confirmed public exploit or proof of concept found in the sources checked.
Our recommendation
- Update winter/wn-backend-module to version 1.2.14 or later in the normal maintenance window.
- Review which users hold backend.manage_branding and backend.manage_editor and reduce these rights to the necessary minimum.
- Prioritise sites with several backend editors, shared admin accounts or third-party plugins.
- Clear the application cache after patching and check the custom CSS settings for unexpected markup.
- Check other Winter CMS CVEs from the same period, such as CVE-2026-125340, which affect the same versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5cwr-5jxg-pcf6 github.com
- Fix commit c95d780 github.com
- Winter CMS release v1.2.14 github.com
- CVE Record CVE-2026-125338 www.cve.org
- OSV GHSA-5cwr-5jxg-pcf6 osv.dev
- Winter CMS releases wintercms.com
- OffSeq threat radar CVE-2026-125338 radar.offseq.com
- OpenCVE CVE-2026-125338 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:11.
Original description (NVD)
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.