GHSA-wvqx-m5px-6cmp
NoneCVSS
—
EPSS
—
Published
Jan 23, 2026
CISA due date
—
The record
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 17.0.0-rc-1 | 17.4.5 |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 17.5.0-rc-1 | 17.8.0-rc-1 |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 7.0-milestone-2 | 16.10.12 |
| maven | org.xwiki.platform/xwiki-platform-web-templates | 17.0.0-rc-1 | 17.4.5 |
| maven | org.xwiki.platform/xwiki-platform-web-templates | 17.5.0-rc-1 | 17.8.0-rc-1 |
| maven | org.xwiki.platform/xwiki-platform-web-templates | 7.0-milestone-2 | 16.10.12 |
Related vulnerabilities
- CVE-2026-24128 XWiki Platform is a generic wiki platform offering runtime services for applications… Same vulnerability
- CVE-2025-66472 XWiki Platform is a generic wiki platform offering runtime services for applications… Also affects org.xwiki.platform:xwiki-platform-web-templates
- GHSA-7vpr-jm38-wr7w XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Also affects org.xwiki.platform:xwiki-platform-web-templates
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79