PT-2026-23065 · Xwiki · Xwiki

CVE-2025-66024 · Published 2026-03-04 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 9.15.7

Description The XWiki blog application is susceptible to Stored Cross-Site Scripting (XSS) through the Blog Post Title. The issue occurs because the post title is directly inserted into the HTML <title> tag without appropriate escaping. An attacker with the ability to create or modify blog posts can inject malicious JavaScript into the title field. This script will then execute in the browser of any user, including administrators, who views the blog post, potentially leading to session hijacking or privilege escalation. The vulnerable parameter is the title field within blog posts.

Recommendations Update to XWiki version 9.15.7 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66024

GHSA-H2XQ-H7F9-VH6C

Affected Products

Xwiki

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66024.json · Exploit
• https://github.com/xwiki-contrib/application-blog/commit/cca87f0a0edc2e7e049d46d51f4a4d8f78b714ba · Patch
• https://github.com/xwiki-contrib/application-blog/security/advisories/GHSA-h2xq-h7f9-vh6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66024 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66024 · Vendor Advisory
• https://jira.xwiki.org/browse/BLOG-245 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2xq-h7f9-vh6c · Vendor Advisory
• https://github.com/xwiki-contrib/application-blog · Note
• https://twitter.com/VulmonFeeds/status/2029351734846304634 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029325087174717505 · Twitter Post
• https://t.me/CVEtracker/46372 · Telegram Post
• https://twitter.com/CVEnew/status/2029323816695152755 · Twitter Post