Cross-Site Scripting Vulnerability in Mocca Calendar by XWiki

CVE-2025-52133

What is CVE-2025-52133?

The Mocca Calendar application prior to version 2.15 exposes a cross-site scripting vulnerability during the calendar import process. An attacker can exploit this flaw by injecting malicious scripts into the calendar title, potentially compromising the security of users' sessions and data. It is essential for users of XWiki to update to the latest version to mitigate this risk and ensure the integrity of their applications.

References