The vulnerability resides in the Less compiler used by Winter CMS. When a backend user with the backend.manage_branding permission places malicious CSS in the Brand Settings Styles field, the system renders the code without sanitization, causing every backend page to display the contaminated stylesheet. This is a stored cross‑site scripting flaw (CWE‑79), enabling attackers to run arbitrary JavaScript in the browsers of other authenticated backend users, potentially leading to session hijacking, credential theft, or other malicious actions that compromise confidentiality, integrity, and availability of the CMS management interface.

Winter CMS, versions earlier than 1.2.13, that allow custom CSS via the Brand Settings page and where users possess the backend.manage_branding permission, are affected.

The CVSS base score is 8.1, indicating high severity. The EPSS score is not available, so the exact likelihood of exploitation is uncertain; however, the flaw can be leveraged by any user who has or can obtain backend.manage_branding rights, making it exploitable in both internal and compromised‑credential scenarios. The vulnerability is not listed in the CISA KEV catalog as of this analysis. Attackers would need to submit a malicious style sheet, after which any other authenticated backend user who views a page would execute the injected code.