Threats tagged 'ghsa-vgp4-2fc4-qff2'

Winter CMS backend module versions 1.2.10 through 1.2.12 have a stored cross-site scripting (XSS) vulnerability in the Editor Settings custom styles feature. Authenticated backend users with the 'backend.manage_editor' permission can inject malicious code via custom styles that are compiled and rendered without proper sanitization. This vulnerability is patched in version 1.2.13.