Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
CVE

CVE-2025-66472

6.5
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Attack Vector
Network
Privileges Req.
None
User Interaction
P
xwiki-platform
Updated Nov 10, 2026View on NVD →
S4E scanner
mediumWeb Vulnerabilities~10 seconds

XWiki DeleteApplication - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates. References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w https://nvd.nist.gov/vuln/detail/CVE-2025-66472 Remediation: Upgrade to XWiki 14.10.14, 15.5.1, 15.8-rc-1 or above. Do not interact with suspiciously crafted links.

url

CVE history: xwiki-platform

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →