CVE-2025-61674 - October CMS Vulnerable to Stored XSS via Editor and Branding Styles

CVE ID : CVE-2025-61674 Published : Jan. 10, 2026, 4:16 a.m. | 1 hour, 19 minutes ago Description : October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended

Source: Telegram CVE Monitor