Stored Cross-Site Scripting Vulnerability in XWiki Blog Application

CVE-2025-66024

What is CVE-2025-66024?

The XWiki Blog Application has a vulnerability allowing attackers to execute malicious JavaScript in users' browsers. This occurs when blog post titles are injected into the HTML tag without proper sanitization. Users with permissions to create or edit blog posts can exploit this flaw to inject harmful scripts. Consequently, this could enable session hijacking or privilege escalation for anyone viewing the affected blog post. Users are encouraged to update to version 9.15.7 or later, where this issue has been resolved by implementing necessary escaping to secure the title field.

References