Cloudanix VulnDB

CVE-2025-61674

Medium · 6.1

October CMS Vulnerable to Stored XSS via Editor and Branding Styles

CVSS

6.1

EPSS

0.3%

Published

Jan 9, 2026

CISA due date

—

The record

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms: - **Editor Settings Markup Styles** A user with the `Global Editor Settings` permission could inject malicious HTML/JS into the stylesheet input at *Settings → Editor Settings → Markup Styles*. A specially crafted input could break out of the intended `<style>` context, allowing arbitrary script execution across backend pages for all users. ---

Affected packages

Ecosystem Package Introduced Fixed
Packagist october/system 0 3.7.13
Packagist october/system 4.0.0 4.0.12
packagist october/system 4.0.0 4.0.12

Related vulnerabilities