CVE-2025-66472

The record

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Affected packages

Related vulnerabilities

• GHSA-7vpr-jm38-wr7w XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Same vulnerability
• CVE-2026-24128 XWiki Platform is a generic wiki platform offering runtime services for applications… Also affects org.xwiki.platform:xwiki-platform-web-templates
• GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Also affects org.xwiki.platform:xwiki-platform-web-templates
• CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
• CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
• CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
• CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
• CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79