Log in Start free

Vulnerability · Published Mar 4, 2026 · Assigned by GitHub_M

CVE-2025-66024XWiki Blog Application home page vulnerable to Stored XSS via Post Title

High 8.6

In plain English

A high-severity cross-site scripting in application-blog-ui from xwiki-contrib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. No known workarounds are available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.contrib.blog:application-blog-ui9.15.7GHSA-h2xq-h7f9-vh6c

Affected products (as reported)

VendorProductVersions
xwiki-contrib application-blog-ui >= 9.15, < 9.15.7

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References