Cross-Site Scripting Vulnerability in Mocca Calendar for XWiki

CVE-2025-52131

What is CVE-2025-52131?

The Mocca Calendar application for XWiki is vulnerable to a cross-site scripting (XSS) attack due to improper validation of user input in the background and text color fields. This vulnerability may allow an attacker to inject malicious scripts into the application, potentially compromising user data and session integrity. It's essential for users to upgrade to version 2.15 or later to mitigate this risk.

References