This flaw arises from how Winter CMS compiles user supplied LESS into CSS. The compiled output is cached without sanitization, only later being stripped when the cache is missed. An attacker who can edit brand or editor styles can inject malicious content that will be stored in the cache and later rendered in backend pages and login screens, causing stored XSS for all users who view those pages.

The vulnerable product is Winter CMS from the vendor wintercms. Versions prior to 1.2.14 are affected, including all releases up to 1.2.13. The issue is fixed in release 1.2.14 and later.

The CVSS score of 4.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with backend.manage_branding or backend.manage_editor authority to edit the custom CSS. The attacker crafts a payload that, when compiled by the LESS engine, becomes executable in the browser, allowing them to execute scripts in the context of the backend interface and any public area that loads those styles.