{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/winter-cms-1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2025-61674"},{"cvss":6.1,"id":"CVE-2025-61676"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Winter CMS (1.2)","October CMS (3.7)","October CMS (4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Winter CMS","October CMS"],"content_html":"\u003cp\u003eWinter CMS and October CMS contain a stored cross-site scripting (XSS) vulnerability allowing authenticated users with high-level administrative permissions to inject malicious CSS. The issue resides in the backend settings for Markup Styles and Backend Styles. When these styles are compiled via the LESS CSS parser, the resulting output is not properly sanitized before being rendered on subsequent backend pages. This allows an attacker with 'backend.manage_editor' or 'backend.manage_branding' permissions to execute arbitrary JavaScript in the context of other administrative sessions. This vulnerability is tracked as CVE-2026-32258 in Winter CMS and CVE-2025-61674 in October CMS. The fix involves implementing the \u003ccode\u003estrip_tags()\u003c/code\u003e function on the output of the \u003ccode\u003erenderCss()\u003c/code\u003e method.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a risk of account takeover and unauthorized actions performed on behalf of other administrative users, including super-administrators, due to the persistent nature of the XSS payload. Successful exploitation requires an attacker to already possess specific backend management permissions, limiting the attack surface to malicious insiders or compromised administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Winter CMS v1.2.13 or later to receive the \u003ccode\u003estrip_tags()\u003c/code\u003e patch for \u003ccode\u003erenderCss()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOctober CMS users should update to v3.7.13 or v4.0.12 to address the related CVE-2025-61674.\u003c/li\u003e\n\u003cli\u003eAudit users assigned the 'backend.manage_editor' and 'backend.manage_branding' permissions to ensure only trusted personnel retain these rights.\u003c/li\u003e\n\u003cli\u003eReview custom CSS and Markup Style settings in the backend for any unauthorized or suspicious injected scripts or CSS tags.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T16:49:19Z","date_published":"2026-08-12T16:49:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/","summary":"Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.","title":"Stored XSS in Winter CMS and October CMS Backend","url":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Winter CMS (1.2)","version":"https://jsonfeed.org/version/1.1"}