Vulnerability · Published Sep 9, 2025 · Assigned by GitHub_M

CVE-2025-55728XWiki Remote Macros vulnerable to remote code execution using the panel macro

Critical 10.0

In plain English

A critical-severity security flaw in xwiki-pro-macros from xwikisas. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.

Affected products (as reported)

Vendor	Product	Versions
xwikisas	xwiki-pro-macros	>= 1.0, < 1.26.5

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 x_refsource_CONFIRM
https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 x_refsource_MISC
https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-20449 x_refsource_MISC