The vulnerability exists in Winter CMS versions 1.2.10 through 1.2.12. Authenticated backend users who possess the backend.manage_editor permission can create and store custom Markup Styles. The system compiles these styles using the LESS parser and then renders them on each backend page without applying any sanitization. As a result, an attacker can inject malicious JavaScript into the custom styles, causing the script to execute in the browsers of other users who view the backend pages. This stored cross‑site scripting can lead to session hijacking, defacement, or execution of additional malicious code within the victim’s browser context, compromising both confidentiality and integrity of the CMS.

The flaw impacts Winter CMS versions 1.2.10, 1.2.11, and 1.2.12. Any user of these releases who has the backend.manage_editor permission can exploit the flaw. Upgrading to version 1.2.13 or later removes the vulnerability.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The attack requires authentication and the ability to grant or possess the backend.manage_editor permission; it is not exploitable over the public network. However, once an authorized user creates a malicious style, any other authenticated user who views a page containing that style will have the embedded JavaScript executed in their browser. The lack of sanitization in the LESS compilation path makes it straightforward for an attacker to embed scripts, making the vulnerability relatively easy to exploit once the user has the necessary permissions.