What is the CVSS score of EUVD-2026-66633?

EUVD-2026-66633 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Winter CMS are affected by EUVD-2026-66633?

Winter CMS backend editor settings contain a stored cross-site scripting vulnerability allowing administrators with editor management permissions to inject malicious code that executes in all other…. A patch is available.

How to fix or mitigate EUVD-2026-66633?

Within 24 hours: inventory all Winter CMS instances across production and staging environments and audit user permissions to identify and restrict the `backend.manage_editor` role to essential personnel only. Within 7 days: deploy the vendor-released patch to all affected Winter CMS installations. Within 30 days: conduct forensic review of backend access logs for suspicious editor or CSS configuration changes, implement supplementary output validation controls beyond the patched code, and establish quarterly access reviews for privileged backend roles.

Winter CMS EUVD-2026-66633

| CVE-2026-32258 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 https://github.com/wintercms/winter

GHSA-vgp4-2fc4-qff2

XSS

8.1

CVSS 3.1 · Vendor: https://github.com/wintercms/winter

Severity by source

Vendor (https://github.com/wintercms/winter) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

PR:H confirmed by mandatory backend permission; scope change (S:C) reflects stored XSS executing in other users' browser sessions; A:N as no availability impact exists.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (https://github.com/wintercms/winter).

CVSS VectorVendor: https://github.com/wintercms/winter

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 15:20 vuln.today

Analysis Generated

Aug 12, 2026 - 15:20 vuln.today

CVE Published

Aug 12, 2026 - 14:40 github-advisory

HIGH 8.1

DescriptionCVE.org

Impact

Authenticated Backend Users with the backend.manage_editor ("Manage editor settings") permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could have allowed a stored XSS attack.

Although this is a valid security issue, it's important to note that its severity is relatively low. To exploit the vulnerability, an attacker would already need to have trusted access to the Winter CMS backend with a specific administrative permission. The Winter CMS maintainers recommend that the backend.manage_editor permission only be granted to trusted administrators and developers.

A related issue exists in the custom CSS field at Settings → Customize Backend → Styles (backend.manage_branding permission), which uses the same rendering mechanism and is addressed separately.

All users are advised to update to the latest version to ensure their systems remain secure.

Patches

This issue has been patched in v1.2.13. The renderCss() method now applies strip_tags() to compiled CSS output before returning it.

Workarounds

Apply https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720 manually if unable to upgrade to v1.2.13.

Resources

CVE-2025-61674 (identical vulnerability in October CMS, patched in v3.7.13 and v4.0.12)

AnalysisAI

Stored cross-site scripting in Winter CMS's backend editor settings allows an authenticated backend user holding the backend.manage_editor permission to inject arbitrary JavaScript that executes in the browsers of all other backend users who load any backend page. The attack exploits LESS CSS's escape syntax (~"...") to break out of the CSS context and embed script tags in compiled output served by renderCss(), which was previously returned unsanitized. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the class of vulnerability is well understood and the specific payload pattern is documented in the patch's test suite.

Technical ContextAI

Winter CMS is a Laravel-based PHP content management system. The vulnerable component is composer/winter/wn-backend-module, specifically the renderCss() static method present in both EditorSetting.php and BrandSetting.php. These models accept user-supplied LESS CSS strings (stored in the database via the backend settings UI) and compile them using the LESS parser before serving the output inline on every backend page load. The LESS language supports an escape sequence (~"literal") that passes arbitrary text through the parser verbatim without sanitization. An attacker with write access to these settings fields can construct a LESS snippet such as .x { content: ~"</style><script>alert(1)</script><style>"; }, which the LESS compiler emits literally into the CSS output, breaking out of the <style> block and injecting executable script. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix applies PHP's strip_tags() to the compiled output in renderCss() before it is returned, preventing HTML tag injection. An identical vulnerability exists in October CMS (CVE-2025-61674), which shares architectural lineage with Winter CMS.

RemediationAI

Upgrade Winter CMS to v1.2.13, which patches the renderCss() method in both EditorSetting.php and BrandSetting.php by applying strip_tags() to compiled CSS output before it is returned. This is a vendor-released patch and is the recommended remediation. Organizations unable to upgrade immediately can manually apply the single-line fix from commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720 (https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720), which changes both return $customCss; calls to return strip_tags($customCss);. As an organizational control while patching is arranged, administrators should audit which backend accounts hold the backend.manage_editor and backend.manage_branding permissions and reduce that set to only developers and highly trusted administrators - note that revoking these permissions will prevent those users from modifying editor and branding styles. The advisory is at https://github.com/wintercms/winter/security/advisories/GHSA-vgp4-2fc4-qff2.