CVE-2026-44179

Name of the Vulnerable Software and Affected Versions XWiki Remote Macros versions 1.13 through 1.14.4

Description The excerpt-include macro fails to properly escape the title of the included page and executes excerpt content using the macro's privileges. This allows for syntax injection via the page title and the excerpt content, specifically within the xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml file. Consequently, any user with page editing permissions, regardless of whether they possess script or programming rights, can inject executable macro syntax to achieve remote code execution, compromising the confidentiality, integrity, and availability of the entire installation.

Recommendations Update XWiki Remote Macros to version 1.14.5.