CVE-2025-61674CWE-79

October CMS Vulnerable to Stored XSS via Editor and Branding Styles

Medium · published January 10, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-10T03:14Z
EPSS history
Timeline
  • 10 JAN 03:14Z
    October CMS Vulnerable to Stored XSS via Editor and Branding Styles
    cvelistv5