CVE-2026-32258

Name of the Vulnerable Software and Affected Versions Winter versions 1.2.10 through 1.2.12

Description Authenticated backend users with the backend.manage editor permission can store custom Markup Styles via Settings → Editor Settings → Markup Styles. These styles are compiled by the LESS parser and rendered on every backend page without sanitization, enabling stored cross-site scripting (XSS). The issue occurs within the renderCss() function, which failed to sanitize the compiled CSS output.

Recommendations Update Winter versions 1.2.10 through 1.2.12 to version 1.2.13. Restrict the backend.manage editor permission to trusted administrators and developers only.