Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

CVE-2026-32258 affects Winter CMS versions 1.2.10 through 1.2.12, a free open-source CMS built on the Laravel PHP framework. Authenticated backend users with the backend.manage_editor permission can exploit this vulnerability by storing malicious custom Markup Styles. These styles are compiled by the LESS parser and rendered without sanitization on every backend page, resulting in stored cross-site scripting (XSS). The vulnerability requires authentication and a specific permission, somewhat limiting the attack surface, but stored XSS can have significant impact affecting all users viewing the backend. The issue has been patched in version 1.2.13. A fix commit and security advisory are available on the Winter CMS GitHub repository.