{"action":"Upgrade winter/wn-backend-module to 1.2.13 or later.","affected":[{"fixed":"1.2.13","introduced":"0"}],"component":"winter/wn-backend-module","cve_ids":["CVE-2026-32257"],"ecosystem":"Packagist","epss":0.00382,"exploited":false,"fixed_versions":["1.2.13"],"ghsa_id":"GHSA-v7cf-8gh9-gxmj","id":"tcs_01M5KF8Y588S4XQ1BQY6ZJJXKA","modified_at":"2026-08-12T14:56:06.749291Z","published_at":"2026-08-12T14:40:21Z","references":["https://osv.dev/vulnerability/GHSA-v7cf-8gh9-gxmj","https://github.com/wintercms/winter/security/advisories/GHSA-v7cf-8gh9-gxmj","https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720","https://github.com/wintercms/winter"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-v7cf-8gh9-gxmj","url":"https://osv.dev/vulnerability/GHSA-v7cf-8gh9-gxmj"}],"summary":"Winter: Stored XSS through Brand Settings custom styles"}