XW
Product
xwiki-platform
On CISA KEVExploited in the wild
227
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 29High 113Medium 82Low 3
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-41933 | 6.5 | Nov 23 | Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default Affected: >= 13.1RC1, < 13.10.8; >= 14.0.0, < 14.4.3 |
| CVE-2022-31167 | 6.5 | Sep 7 | XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference Affected: >= 5.0, < 12.10.11; >= 13.0, < 13.4.6; >= 13.10, < 13.10.1 |
| CVE-2022-23617 | 6.5 | Feb 9 | Missing authorization in xwiki-platform Affected: >= 13.0.0, < 13.2-rc-1; < 12.10.6 |
| CVE-2021-32732 | 6.5 | Feb 4 | Cross-Site Request Forgery in xwiki-platform Affected: < 12.10.5 ; >= 13.0, < 13.2RC1 |
| CVE-2023-50732 | 6.3 | Dec 21 | Velocity execution without script right through tree macro Affected: >= 8.3-rc-1, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-41046 | 6.3 | Sep 1 | Velocity execution without script rights in Xwiki platform Affected: >= 7.2, < 14.10.10; >= 15.0-rc-1, < 15.4-rc-1 |
| CVE-2026-40105 | 6.1 | Apr 15 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality Affected: >= 10.4-rc-1, < 16.10.16; >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1 |
| CVE-2026-26000 | 6.1 | Feb 12 | XWiki Platform affected by click-jacking through CSS injection in comments Affected: >= 17.5.0, < 17.9.0; >= 17.0.0-rc-1, < 17.4.6; < 16.10.13 |
| CVE-2026-24128 | 6.1 | Jan 23 | XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Affected: >= 7.0-milestone-2, < 16.10.12; >= 17.0.0-rc-1, < 17.4.5; >= 17.5.0-rc-1, < 17.8.0-rc-1 |
| CVE-2025-66472 | 6.1 | Dec 10 | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Affected: org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10; org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 17.0.0-rc-1, < 17.4.2; org.xwiki.platform:xwiki-platform-web-templates >= 6.2-milestone-1, < 16.10.10; org.xwiki.platform:xwiki-platform-web-templates >= 17.0.0-rc-1, < 17.4.2 |
| CVE-2025-32430 | 6.1 | Aug 5 | XWiki Platform contains Reflected XSS vulnerability in two templates Affected: >= 4.2-milestone-3, < 16.4.8; >= 16.5.0-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1 |
| CVE-2025-32970 | 6.1 | Apr 30 | org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability Affected: >= 13.5-rc-1, < 15.10.13; >= 16.0.0-rc-1, < 16.4.4; >= 16.5.0-rc-1, < 16.8.0 |
| CVE-2023-46732 | 6.1 | Nov 6 | Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform Affected: >= 9.7-rc-1, < 14.10.14; >= 15.0-rc-1, < 15.5.1 |
| CVE-2023-35162 | 6.1 | Jun 23 | XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template Affected: >= 6.1-rc-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-35161 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page Affected: >= 6.2-milestone-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-35160 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template Affected: >= 2.5-milestone-2, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-35159 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template Affected: >= 3.4-milestone-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-35158 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template Affected: >= 9.4-rc-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-35156 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template Affected: >= 6.0-rc-1, < 14.10.6; >= 15.0-rc-0, < 15.1 |
| CVE-2023-35155 | 6.1 | Jun 23 | XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email Affected: >= 2.6-rc-2, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-32068 | 6.1 | May 15 | URL Redirection to Untrusted Site in XWiki Affected: < 14.10.4 |
| CVE-2023-29506 | 6.1 | Apr 16 | org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints Affected: >= 13.10.8, < 13.10.11; >= 14.4.3, < 14.4.7; >= 14.6, < 14.10 |
| CVE-2023-29204 | 6.1 | Apr 15 | URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore Affected: >= 6.0-rc-1, < 13.10.10; >= 14.0-rc-1, < 14.4.4; >= 14.5, < 14.8-rc-1 |
| CVE-2022-36097 | 6.1 | Sep 8 | XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form Affected: >= 14.0-rc-1, < 14.4-rc-1 |
| CVE-2022-29258 | 6.1 | May 31 | Cross-site Scripting in Filter Stream Converter Application in XWiki Platform Affected: >= 5.4.4, <= 6.0-milestone-2; >= 6.0-milestone-2, < 12.10.11; >= 13.0.0, < 13.4.7; >= 13.5.0, < 13.10.3 |
| CVE-2022-29251 | 6.1 | May 25 | Cross-site Scripting in the Flamingo theme manager Affected: >= 6.2.4, < 12.10.11; >= 13.0, < 13.4.7; >= 13.5, < 13.10.3 |
| CVE-2022-29252 | 6.1 | May 25 | Cross-site Scripting in XWiki Platform Wiki UI Main Wiki Affected: >= 5.3-milestone-2, < 12.10.11; >= 13.0, < 13.4.7; >= 13.5, < 13.10.3 |
| CVE-2022-23622 | 6.1 | Feb 9 | Cross site scripting in registration template in xwiki-platform Affected: >= 2.6.1, < 12.10.11; >= 13.0.0, < 13.4.7; >= 13.10.0, < 13.10.3 |
| CVE-2022-23618 | 6.1 | Feb 9 | Open Redirect in xwiki-platform Affected: >= 13.0.0, < 13.3RC1; < 12.10.7 |
| CVE-2026-48047 | 5.9 | Aug 7 | XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin Affected: >= 9.6-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 |
| CVE-2021-32730 | 5.7 | Jul 1 | No CSRF protection on the password change form Affected: < 12.10.5; >= 13.0, <= 13.1 |
| CVE-2024-55876 | 5.4 | Dec 12 | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user Affected: >= 1.2-milestone-2, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 |
| CVE-2024-43400 | 5.4 | Aug 19 | XWiki Platform allows XSS through XClass name in string properties Affected: >= 15.6-rc-1, < 15.10.2; >= 15.0-rc-1, < 15.5.5; < 14.10.21; = 16.0.0-rc-1 |
| CVE-2024-41947 | 5.4 | Jul 31 | XWiki Platform XSS through conflict resolution Affected: >= 11.8-rc-1, < 15.10.8; >= 16.0.0-rc-1, < 16.3.0-rc-1 |
| CVE-2024-31985 | 5.4 | Apr 10 | XWiki Platform CSRF in the job scheduler Affected: >= 3.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9 |
| CVE-2023-45137 | 5.4 | Oct 25 | XWiki Platform XSS with edit right in the create document form for existing pages Affected: >= 3.1-milestone-2, < 13.4-rc-1; >= 14.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1 |
| CVE-2023-40176 | 5.4 | Aug 23 | SXSS in the user profile via the timezone displayer Affected: >= 4.1-milestone-2, < 14.10.5 |
| CVE-2023-36477 | 5.4 | Jun 30 | Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform Affected: org.xwiki.contrib:application-ckeditor-ui: >= 1.9, < 1.64.9; org.xwiki.platform:xwiki-platform-ckeditor-ui: >= 14.6-rc-1, < 14.10.6; org.xwiki.platform:xwiki-platform-ckeditor-ui: >= 15.0, < 15.1 |
| CVE-2023-35153 | 5.4 | Jun 23 | XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters Affected: >= 5.4.4, < 14.4.8; >= 14.5, < 14.10.4; >= 15.0-rc-1, < 15.0 |
| CVE-2023-34464 | 5.4 | Jun 23 | XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template Affected: org.xwiki.platform:xwiki-platform-web >= 2.2.1, < 14.4.8; org.xwiki.platform:xwiki-platform-web-templates < 14.4.8; org.xwiki.platform:xwiki-platform-web-templates >= 14.5, < 14.10.5; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-29515 | 5.4 | Apr 18 | Cross-site scripting (XSS) in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29508 | 5.4 | Apr 16 | org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting Affected: >= 13.10.10, < 13.10.11; >= 14.4, < 14.4.7; >= 14.9, < 14.10 |
| CVE-2023-29206 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins Affected: >= 3.0-milestone-1, < 14.9-rc-1 |
| CVE-2023-29205 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro Affected: < 14.8-rc-1 |
| CVE-2023-26056 | 5.4 | Mar 2 | XWiki Platform allows macro execution as any user without programming rights through the context macro Affected: >= 3.0-milestone-1, < 13.10.10; >= 14.0-rc-1, < 14.4.5; >= 14.5, < 14.8-rc-1 |
| CVE-2023-26480 | 5.4 | Mar 2 | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data Affected: >= 12.10, < 13.10.10; >= 14.0, < 14.4.7; >= 14.5, < 14.9 |
| CVE-2022-23620 | 5.4 | Feb 9 | Path traversal in xwiki-platform-skin-skinx Affected: >= 6.2-rc-1, < 13.6 |
| CVE-2022-23615 | 5.4 | Feb 9 | Partial authorization bypass on document save in xwiki-platform Affected: >= 1.0, < 13.0 |
| CVE-2021-43841 | 5.4 | Feb 4 | XSS by SVG upload in xwiki-platform Affected: < 12.10.6; >= 13.0, < 13.3RC1 |
| CVE-2021-32729 | 5.4 | Jul 1 | A user without PR can reset user authentication failures information Affected: > 11.6RC1, < 12.6.8; >= 12.10.0, < 12.10.4 |