GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles Vulnerability ID: GHSA-5CWR-5JXG-PCF6 CVSS Score: 8.4 Published: 2026-08-20 Winter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and…
Stored Cross-Site Scripting (XSS) vulnerability in Winter CMS versions prior to 1.2.14 allows attackers with backend branding or editor configuration permissions to inject arbitrary JavaScript. The flaw exists in the custom styles rendering pipeline for Brand Settings and Editor Settings. The attacker's malicious code is written to the cache without sanitization.
When subsequent page requests hit the cache, the raw, unsanitized JavaScript is output directly into the backend interface, bypassing security filters and resulting in execution of the attacker's JavaScript in other administrative users' sessions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
