The Winter CMS backend module allows authenticated users with the 'backend.manage_editor' permission to provide custom styles through Settings → Editor Settings → Markup Styles. These styles are compiled using the LESS CSS parser and rendered on every backend page. Prior to version 1.2.13, the compiled CSS output was not sanitized, enabling a stored XSS vulnerability (CWE-79). An attacker with the required permission could inject malicious scripts that execute in the context of other backend users. The vulnerability is patched in version 1.2.13 by applying the PHP strip_tags() function to the compiled CSS output before rendering. A related issue exists in the custom CSS field under backend branding settings, addressed separately.

Successful exploitation allows an authenticated backend user with 'backend.manage_editor' permission to execute arbitrary scripts in the context of other backend users, potentially leading to credential theft or session hijacking. However, exploitation requires trusted access with specific administrative permissions, limiting the attack surface. The vulnerability does not affect unauthenticated users or users without the required permission.

A patch is available in Winter CMS backend module version 1.2.13, which sanitizes the compiled CSS output to prevent stored XSS. Users should upgrade to version 1.2.13 or later. If upgrading is not immediately possible, the patch can be applied manually from the referenced GitHub commit. Additionally, it is recommended to restrict the 'backend.manage_editor' permission to trusted administrators and developers only.