Cross-Site Scripting Vulnerability in Mocca Calendar Application by XWiki

CVE-2025-52132

What is CVE-2025-52132?

The Mocca Calendar application prior to version 2.15 for XWiki is susceptible to a cross-site scripting (XSS) attack. This vulnerability arises when user input in the event title is not properly sanitized before being rendered on the view event page. This lack of input validation can allow malicious users to inject arbitrary script code, which can execute in the browser of any user viewing the calendar page. Exploiting this vulnerability could lead to potential data theft, session hijacking, or other harmful actions against users interacting with the affected application.

References