Answer in brief
CVE-2026-125340 records a Medium severity (CVSS 4.5) vulnerability in Winter CMS: Reflected XSS through the search query parameter in the backend Table widget. The current sources do not mark it as known exploited. The current feed maps winter/wn-backend-module (composer), wintercms/winter (generic), winter/wn-backend-module (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps winter/wn-backend-module (composer), wintercms/winter (generic), winter/wn-backend-module (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| winter/wn-backend-modulecomposer | >=1.0.420,<=1.2.13 | 1.2.14 |
| wintercms/wintergeneric | >=1.0.420 <1.2.14 | 1.2.14 |
| winter/wn-backend-modulepackagist | >=1.0.420 <1.2.14 | 1.2.14 |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 20, 2026
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.
Quoted source text, attributed separately from HOL analysis.