CVE-2026-125338

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.14

Description Stored cross-site scripting occurs because the renderCss() functions in BrandSetting and EditorSetting store raw LESS compiler output using Cache::forever(). The strip tags() function is only applied to values returned during a cache miss. Consequently, while the initial render after saving custom CSS appears sanitized, an unsafe entry is created in the cache. Subsequent cache hits return unsanitized output into the backend style element. This allows users with backend.manage branding or backend.manage editor permissions to execute scripts when backend pages, including unauthenticated sign-in, password restore, and password reset layouts, render the styles.

Recommendations Update Winter CMS to version 1.2.14.