CVE-2026-125341Winter: Stored XSS through Backend List widget image columnsWinter: Stored XSS through Backend List widget image columns