# org.xwiki.platform:xwiki-platform-web (Maven) vulnerabilities

15 known vulnerabilities (5 critical, 5 high, 5 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.xwiki.platform/xwiki-platform-web

## Advisories (15)

### [CVE-2026-26000](https://cve.now/CVE-2026-26000): XWiki Platform affected by click-jacking through CSS injection in comments

- Severity: Medium 5.3
- Published: Feb 12, 2026
- Affected: from 17.5.0, fixed in 17.9.0; from 17.0.0-rc-1, fixed in 17.4.6; fixed in 16.10.13.

### [CVE-2023-45137](https://cve.now/CVE-2023-45137): XWiki Platform XSS with edit right in the create document form for existing pages

- Severity: Critical 9.1
- Published: Oct 25, 2023
- Affected: from 3.1-milestone-2, fixed in 13.4-rc-1.

### [CVE-2023-45135](https://cve.now/CVE-2023-45135): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

- Severity: Critical 9.1
- Published: Oct 25, 2023
- Affected: from 7.2-milestone-2, fixed in 14.10.12.

### [CVE-2023-45134](https://cve.now/CVE-2023-45134): XWiki Platform XSS vulnerability from account in the create page form via template provider

- Severity: Critical 9.1
- Published: Oct 25, 2023
- Affected: from 3.1-milestone-1, fixed in 13.4-rc-1.

### [CVE-2023-34464](https://cve.now/CVE-2023-34464): XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template

- Severity: Critical 9.1
- Published: Jun 23, 2023
- Affected: from 2.2.1, fixed in 14.4.8.

### [CVE-2023-29207](https://cve.now/CVE-2023-29207): Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro

- Severity: High 8.9
- Published: Apr 15, 2023
- Affected: from 1.9-milestone-2, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.6; from 14.5, fixed in 14.9.

### [CVE-2023-26473](https://cve.now/CVE-2023-26473): XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm

- Severity: Medium 6.5
- Published: Mar 2, 2023
- Affected: from 1.3-rc-1, fixed in 13.10.11; from 14.0, fixed in 14.4.7; from 14.5, fixed in 14.10.

### [CVE-2022-36094](https://cve.now/CVE-2022-36094): XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

- Severity: High 8.9
- Published: Sep 8, 2022
- Affected: from 1.0, fixed in 13.10.6; from 14.0, fixed in 14.3-rc-1.

### [CVE-2022-36093](https://cve.now/CVE-2022-36093): XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

- Severity: High 8.5
- Published: Sep 8, 2022
- Affected: from 8.0-rc-1, fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1.

### [CVE-2022-36091](https://cve.now/CVE-2022-36091): XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor

- Severity: High 7.5
- Published: Sep 8, 2022
- Affected: from 14.0, fixed in 14.2.

### [CVE-2022-24820](https://cve.now/CVE-2022-24820): Unauthenticated user can list hidden document from multiple velocity templates

- Severity: Medium 5.3
- Published: Apr 8, 2022
- Affected: fixed in 12.10.11; from 13.0.0, fixed in 13.4.4; from 13.5.0, fixed in 13.9.

### [CVE-2022-23619](https://cve.now/CVE-2022-23619): Information exposure in xwiki-platform

- Severity: Medium 5.3
- Published: Feb 9, 2022
- Affected: from 13.5RC1, fixed in 13.6RC1; from 13.0.0, fixed in 13.4.1; fixed in 12.10.9.

### [CVE-2021-32731](https://cve.now/CVE-2021-32731): The reset password form reveal users email address

- Severity: Medium 5.3
- Published: Jul 1, 2021
- Affected: from 13.1, fixed in 13.2.

### [CVE-2021-29459](https://cve.now/CVE-2021-29459): XSS Cross Site Scripting

- Severity: Critical 9.6
- Published: Apr 20, 2021
- Affected: fixed in 12.6.3; from 12.6.4, fixed in 12.8.

### [CVE-2020-13654](https://cve.now/CVE-2020-13654): XWiki Platform before 12.8 mishandles escaping in the property displayer.

- Severity: High 7.5
- Published: Dec 31, 2020
- Affected: fixed in 12.8.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.xwiki.platform:xwiki-platform-web
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.