Xwiki-contrib vulnerabilities
We track 11 vulnerabilities in Xwiki-contrib products across 9 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on March 4, 2026.
Latest Xwiki-contrib vulnerabilities
- 9.0 Critical severity
application-blog-ui: Improper Neutralization of Input During Web Page Generation
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the pos
- 10.0 Critical severity
macro-fullcalendar: Improper Neutralization of Special Elements used in an SQL Command
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or startin
- 9.2 Critical severity
oidc: Improper Authorization
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token
- 8.7 High severity
application-blog: Improper Neutralization of Directives in Dynamically Evaluated Code
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in use
- 9.0 Critical severity
syntax-markdown: Improper Neutralization of Input During Web Page Generation
XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, u
- 7.7 High severity
jira: Improper Restriction of XML External Entity Reference
The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIR
- 8.8 High severity
application-admintools: Cross-Site Request Forgery
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki install
- 8.8 High severity
application-admintools: Cross-Site Request Forgery
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker
- 9.6 Critical severity
application-changerequest: Improper Neutralization of Input During Web Page Generation
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote
- 8.8 High severity
application-ckeditor: Cross-Site Request Forgery
CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current
- 7.5 High severity
oidc: Improper Authentication
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request pa