CVE-2025-66472CWE-79CWE-80cross-site-scripting

CVE-2025-66472

Medium · published December 11, 2025

CVSS v3.1
6.1
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-12-11T03:16Z
Affected products (2)
ProductVersionsFixed in
xwiki/xwiki≥ 6.2, < 16.10.1016.10.10
xwiki/xwiki≥ 17.0.0, < 17.4.217.4.2
References (3)
https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2 · [email protected]https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w · [email protected]https://jira.xwiki.org/browse/XWIKI-23244 · [email protected]
EPSS history
Timeline
  • 10 DEC 21:34Z
    XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
    cvelistv5