Stored XSS in Winter CMS and October CMS Backend

Winter CMS and October CMS contain a stored cross-site scripting (XSS) vulnerability allowing authenticated users with high-level administrative permissions to inject malicious CSS. The issue resides in the backend settings for Markup Styles and Backend Styles. When these styles are compiled via the LESS CSS parser, the resulting output is not properly sanitized before being rendered on subsequent backend pages. This allows an attacker with 'backend.manage_editor' or 'backend.manage_branding' permissions to execute arbitrary JavaScript in the context of other administrative sessions. This vulnerability is tracked as CVE-2026-32258 in Winter CMS and CVE-2025-61674 in October CMS. The fix involves implementing the strip_tags() function on the output of the renderCss() method.

Impact

The vulnerability poses a risk of account takeover and unauthorized actions performed on behalf of other administrative users, including super-administrators, due to the persistent nature of the XSS payload. Successful exploitation requires an attacker to already possess specific backend management permissions, limiting the attack surface to malicious insiders or compromised administrative accounts.

Recommendation

• Upgrade to Winter CMS v1.2.13 or later to receive the strip_tags() patch for renderCss().
• October CMS users should update to v3.7.13 or v4.0.12 to address the related CVE-2025-61674.
• Audit users assigned the 'backend.manage_editor' and 'backend.manage_branding' permissions to ensure only trusted personnel retain these rights.
• Review custom CSS and Markup Style settings in the backend for any unauthorized or suspicious injected scripts or CSS tags.