Xwiki-rendering vulnerabilities

6 known vulnerabilities in Xwiki-rendering from XWiki. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  xwiki-rendering: Improper Neutralization of Directives in Dynamically Evaluated Code

  CVE-2025-53837Sep 18, 2026XWikiEPSS 1.5%

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document ca

• 8.8 High severity

  xwiki-rendering: Improper Control of Generation of Code

  CVE-2025-66474Dec 10, 2025XWikiEPSS 1.09%

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient prote

• 8.8 High severity

  xwiki-rendering: Improper Control of Generation of Code

  CVE-2025-53836Jul 15, 2025XWiki

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro cont

• 9.0 Critical severity

  xwiki-rendering: Improper Neutralization of Input During Web Page Generation

  CVE-2025-53835Jul 14, 2025XWiki

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syn

• 8.8 High severity

  xwiki-rendering: Privilege Context Switching Error

  CVE-2023-37912Oct 25, 2023XWikiEPSS 1.45%

  XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and

• 9.6 Critical severity

  xwiki-rendering: Improper Neutralization of Input During Web Page Generation

  CVE-2023-37908Oct 25, 2023XWikiEPSS 1.11%

  XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-sit