← Vulnerability feed

Vulnerability record · CVE-2023-52084 · published 28 December 2023

CVE-2023-52084: Wintercms winter cross-site scripting vulnerability

Wintercms · Winter

Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.

5.4 CVSS 3.1 Medium EPSS 0.31% · top 78.8% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wintercms/winter/commit/517f65dfae679b57575b047de13c5af48915a5ba Patch
https://github.com/wintercms/winter/security/advisories/GHSA-43w4-4j3c-jx29 PatchVendor Advisory
https://github.com/wintercms/winter/commit/517f65dfae679b57575b047de13c5af48915a5ba Patch
https://github.com/wintercms/winter/security/advisories/GHSA-43w4-4j3c-jx29 PatchVendor Advisory

Track CVE-2023-52084 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-27591Wintercms winter improper access control vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS al…EPSS 0.57%9.8CVE-2022-39357Wintercms winter prototype pollution vulnerabilityWinter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2…EPSS 1.1%8.4CVE-2024-54149Wintercms winter vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0…EPSS 0.42%7.2CVE-2024-29686Wintercms winter vulnerabilityServer-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to…EPSS 1.8%5.4CVE-2023-52085Wintercms winter path traversal vulnerabilityWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value…EPSS 30%4.8CVE-2023-52083Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media…EPSS 0.31%4.8CVE-2023-37269Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission…EPSS 2.7%3.5CVE-2026-22254Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users wi…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2023-52084), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.