CVE-2026-26000
Medium · 6.1CVSS
6.1
EPSS
0.4%
Published
Feb 12, 2026
CISA due date
—
The record
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-web | 0 | 16.10.13 |
| Maven | org.xwiki.platform:xwiki-platform-web | 17.0.0-rc-1 | 17.4.6 |
| Maven | org.xwiki.platform:xwiki-platform-web | 17.5.0 | 17.9.0 |
Related vulnerabilities
- GHSA-74rh-c5rh-88vg XWiki vulnerable to click-jacking through CSS injection in comments Same vulnerability
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-1021
- CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-1021
- CVE-2026-87538 Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-1021
- CVE-2026-87486 Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to… CWE-1021
- CVE-2026-84139 Clickjacking issue in the DOM: Events component. CWE-1021
- CVE-2026-75548 The affected Ebyte device web management interface does not restrict the interface from… CWE-1021
- CVE-2026-18534 ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a… CWE-1021