- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 23 · 11 critical, 4 high, 7 medium, 1 low
- Registry
- Maven Central
Advisories 23
- CVE-2026-40105Medium 6.5
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
Affected: from 10.4-rc-1, fixed in 16.10.16; from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1.
- CVE-2026-24128Medium 6.5
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Affected: from 7.0-milestone-2, fixed in 16.10.12; from 17.0.0-rc-1, fixed in 17.4.5; from 17.5.0-rc-1, fixed in 17.8.0-rc-1.
- CVE-2025-66472Medium 6.5
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Affected: from 6.2-milestone-1, fixed in 16.10.10; from 17.0.0-rc-1, fixed in 17.4.2.
- CVE-2025-32430Medium 6.5
XWiki Platform contains Reflected XSS vulnerability in two templates
Affected: from 4.2-milestone-3, fixed in 16.4.8; from 16.5.0-rc-1, fixed in 16.10.6; from 17.0.0-rc-1, fixed in 17.3.0-rc-1.
- CVE-2024-43401Critical 9.1
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
Affected: fixed in 15.10-rc-1.
- CVE-2024-41947Critical 9.1
XWiki Platform XSS through conflict resolution
Affected: from 11.8-rc-1, fixed in 15.10.8; from 16.0.0-rc-1, fixed in 16.3.0-rc-1.
- CVE-2023-45137Critical 9.1
XWiki Platform XSS with edit right in the create document form for existing pages
Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1.
- CVE-2023-45136Critical 9.7
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
Affected: from 12.0-rc-1, fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1.
- CVE-2023-45135Critical 9.1
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1.
- CVE-2023-45134Critical 9.1
XWiki Platform XSS vulnerability from account in the create page form via template provider
Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1.
- CVE-2023-40176Critical 9.1
SXSS in the user profile via the timezone displayer
Affected: from 4.1-milestone-2, fixed in 14.10.5.
- CVE-2023-35160Critical 9.7
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
Affected: from 2.5-milestone-2, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1.
- CVE-2023-35159Critical 9.7
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
Affected: from 3.4-milestone-1, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1.
- CVE-2023-34464Critical 9.1
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
Affected: fixed in 14.4.8; from 14.5, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1.
- CVE-2023-29513Medium 5.0
Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
Affected: from 8.0-rc-1, fixed in 14.10.1.
Show all 23 advisoriesShow fewer advisories
- CVE-2023-29512Critical 9.9
Code injection in xwiki-platform-web-templates
Affected: from 1.0B1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.1.
- CVE-2023-29207High 8.9
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
Affected: from 1.9-milestone-2, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.6; from 14.5, fixed in 14.9.
- CVE-2023-29203Low 3.7
Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
Affected: from 13.9-rc-1, fixed in 13.10.8; from 14.0-rc-1, fixed in 14.4.3; from 14.5, fixed in 14.7-rc-1.
- CVE-2022-36095Medium 4.3
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Affected: from 2.0-milestone-1, fixed in 13.10.5; from 14.0, fixed in 14.3.
- CVE-2022-36093High 8.5
XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
Affected: fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1.
- CVE-2022-36091High 7.5
XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor
Affected: from 1.3, fixed in 13.10.4.
- CVE-2022-24819Medium 5.3
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Affected: fixed in 12.10.11; from 13.0.0, fixed in 13.4.4; from 13.5.0, fixed in 13.9.
- CVE-2022-23622High 7.4
Cross site scripting in registration template in xwiki-platform
Affected: from 2.6.1, fixed in 12.10.11; from 13.0.0, fixed in 13.4.7; from 13.10.0, fixed in 13.10.3.