PT-2026-6729 · WordPress · Mattermost Confluence Plugin

Daw10 · Published 2026-02-06 · Updated 2026-03-03 · CVE-2025-13523

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Confluence plugin versions prior to 1.7.0

Description The Mattermost Confluence plugin does not properly sanitize user-controlled display names when rendering HTML templates. This allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in a victim’s browser. The issue occurs when a specially crafted OAuth2 connection link is sent and visited, rendering the attacker’s display name without proper sanitization. The vulnerable component is the HTML template rendering process. The display name is the vulnerable parameter.

Recommendations Update the Mattermost Confluence plugin to version 1.7.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13523

GHSA-FFX7-34P2-VM3W

GO-2026-4456

SUSE-SU-2026:0757-1

Affected Products

Mattermost Confluence Plugin

References · 116

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4456 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13523 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffx7-34p2-vm3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13523 · Vendor Advisory
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2017-18911 · Note
• https://suse.com/security/cve/CVE-2026-20796 · Note
• https://suse.com/security/cve/CVE-2025-64641 · Note
• https://suse.com/security/cve/CVE-2025-14435 · Note
• https://twitter.com/cracbot/status/2021539770577699186 · Twitter Post
• https://suse.com/security/cve/CVE-2025-50180 · Note
• https://suse.com/security/cve/CVE-2026-25518 · Note
• https://suse.com/security/cve/CVE-2026-26190 · Note