CVE-2025-66024

Name of the Vulnerable Software and Affected Versions XWiki blog application versions prior to 9.15.7

Description The XWiki blog application is subject to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server. The issue occurs because the blog post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script executes in the browser of any user, including administrators, who views the blog post, potentially leading to session hijacking or privilege escalation.

Recommendations Update the XWiki blog application to version 9.15.7.