Threats tagged 'ghsa-v7cf-8gh9-gxmj'

Winter CMS backend module versions prior to 1.2.13 have a stored cross-site scripting (XSS) vulnerability in the Brand Settings custom styles feature. This flaw allows users with the backend.manage_branding permission to inject malicious CSS that is compiled and rendered on every backend page without proper sanitization. The vulnerability requires trusted backend access with specific administrative permissions, which limits its severity. The issue is patched in version 1.2.13.