CVE-2026-32258High· 8.1▾ TwilightWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
winter/wn-backend-module >= 1.2.10, < 1.2.13Patched in:
winter/wn-backend-module 1.2.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32257High· 8.1Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework
GHSA-7mpf-4465-7fc2Low· 2.0Winter: Stored XSS through Backend List widget image columns
GHSA-5cwr-5jxg-pcf6Medium· 4.5Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
GHSA-hq84-x37p-j6q5Medium· 4.5Winter: Reflected XSS through the search query parameter in the backend Table widget
CVE-2026-54256Medium· 5.4Winter CMS is a content management system built on the Laravel PHP framework
CVE-2026-63179Medium· 4.9Winter CMS is a content management system built on the Laravel PHP framework