# org.xwiki.platform:xwiki-platform-web-templates (Maven) vulnerabilities 23 known vulnerabilities (11 critical, 4 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.xwiki.platform/xwiki-platform-web-templates ## Advisories (23) ### [CVE-2026-40105](https://cve.now/CVE-2026-40105): XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality - Severity: Medium 6.5 - Published: Apr 15, 2026 - Affected: from 10.4-rc-1, fixed in 16.10.16; from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1. ### [CVE-2026-24128](https://cve.now/CVE-2026-24128): XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages - Severity: Medium 6.5 - Published: Jan 23, 2026 - Affected: from 7.0-milestone-2, fixed in 16.10.12; from 17.0.0-rc-1, fixed in 17.4.5; from 17.5.0-rc-1, fixed in 17.8.0-rc-1. ### [CVE-2025-66472](https://cve.now/CVE-2025-66472): XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication - Severity: Medium 6.5 - Published: Dec 10, 2025 - Affected: from 6.2-milestone-1, fixed in 16.10.10; from 17.0.0-rc-1, fixed in 17.4.2. ### [CVE-2025-32430](https://cve.now/CVE-2025-32430): XWiki Platform contains Reflected XSS vulnerability in two templates - Severity: Medium 6.5 - Published: Aug 5, 2025 - Affected: from 4.2-milestone-3, fixed in 16.4.8; from 16.5.0-rc-1, fixed in 16.10.6; from 17.0.0-rc-1, fixed in 17.3.0-rc-1. ### [CVE-2024-43401](https://cve.now/CVE-2024-43401): In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them - Severity: Critical 9.1 - Published: Aug 19, 2024 - Affected: fixed in 15.10-rc-1. ### [CVE-2024-41947](https://cve.now/CVE-2024-41947): XWiki Platform XSS through conflict resolution - Severity: Critical 9.1 - Published: Jul 31, 2024 - Affected: from 11.8-rc-1, fixed in 15.10.8; from 16.0.0-rc-1, fixed in 16.3.0-rc-1. ### [CVE-2023-45137](https://cve.now/CVE-2023-45137): XWiki Platform XSS with edit right in the create document form for existing pages - Severity: Critical 9.1 - Published: Oct 25, 2023 - Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1. ### [CVE-2023-45136](https://cve.now/CVE-2023-45136): XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled - Severity: Critical 9.7 - Published: Oct 25, 2023 - Affected: from 12.0-rc-1, fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1. ### [CVE-2023-45135](https://cve.now/CVE-2023-45135): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title - Severity: Critical 9.1 - Published: Oct 25, 2023 - Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1. ### [CVE-2023-45134](https://cve.now/CVE-2023-45134): XWiki Platform XSS vulnerability from account in the create page form via template provider - Severity: Critical 9.1 - Published: Oct 25, 2023 - Affected: fixed in 14.10.12; from 15.0-rc-1, fixed in 15.5-rc-1. ### [CVE-2023-40176](https://cve.now/CVE-2023-40176): SXSS in the user profile via the timezone displayer - Severity: Critical 9.1 - Published: Aug 23, 2023 - Affected: from 4.1-milestone-2, fixed in 14.10.5. ### [CVE-2023-35160](https://cve.now/CVE-2023-35160): XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template - Severity: Critical 9.7 - Published: Jun 23, 2023 - Affected: from 2.5-milestone-2, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1. ### [CVE-2023-35159](https://cve.now/CVE-2023-35159): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template - Severity: Critical 9.7 - Published: Jun 23, 2023 - Affected: from 3.4-milestone-1, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1. ### [CVE-2023-34464](https://cve.now/CVE-2023-34464): XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template - Severity: Critical 9.1 - Published: Jun 23, 2023 - Affected: fixed in 14.4.8; from 14.5, fixed in 14.10.5; from 15.0-rc-1, fixed in 15.1-rc-1. ### [CVE-2023-29513](https://cve.now/CVE-2023-29513): Users can be created even when registration is disabled without validation via the template macro in xwiki-platform - Severity: Medium 5.0 - Published: Apr 18, 2023 - Affected: from 8.0-rc-1, fixed in 14.10.1. ### [CVE-2023-29512](https://cve.now/CVE-2023-29512): Code injection in xwiki-platform-web-templates - Severity: Critical 9.9 - Published: Apr 18, 2023 - Affected: from 1.0B1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.1. ### [CVE-2023-29207](https://cve.now/CVE-2023-29207): Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro - Severity: High 8.9 - Published: Apr 15, 2023 - Affected: from 1.9-milestone-2, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.6; from 14.5, fixed in 14.9. ### [CVE-2023-29203](https://cve.now/CVE-2023-29203): Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm - Severity: Low 3.7 - Published: Apr 15, 2023 - Affected: from 13.9-rc-1, fixed in 13.10.8; from 14.0-rc-1, fixed in 14.4.3; from 14.5, fixed in 14.7-rc-1. ### [CVE-2022-36095](https://cve.now/CVE-2022-36095): XWiki Cross-Site Request Forgery (CSRF) for actions on tags - Severity: Medium 4.3 - Published: Sep 8, 2022 - Affected: from 2.0-milestone-1, fixed in 13.10.5; from 14.0, fixed in 14.3. ### [CVE-2022-36093](https://cve.now/CVE-2022-36093): XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard - Severity: High 8.5 - Published: Sep 8, 2022 - Affected: fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1. ### [CVE-2022-36091](https://cve.now/CVE-2022-36091): XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor - Severity: High 7.5 - Published: Sep 8, 2022 - Affected: from 1.3, fixed in 13.10.4. ### [CVE-2022-24819](https://cve.now/CVE-2022-24819): Unauthenticated user can retrieve the list of users through uorgsuggest.vm - Severity: Medium 5.3 - Published: Apr 8, 2022 - Affected: fixed in 12.10.11; from 13.0.0, fixed in 13.4.4; from 13.5.0, fixed in 13.9. ### [CVE-2022-23622](https://cve.now/CVE-2022-23622): Cross site scripting in registration template in xwiki-platform - Severity: High 7.4 - Published: Feb 9, 2022 - Affected: from 2.6.1, fixed in 12.10.11; from 13.0.0, fixed in 13.4.7; from 13.10.0, fixed in 13.10.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.xwiki.platform:xwiki-platform-web-templates Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.