CVE-2025-13523
Unknown Unknown - Not Provided

Cross-Site Scripting in Mattermost Confluence Plugin

Publication date: 2026-02-06

Last updated on: 2026-02-24

Assigner: Mattermost, Inc.

Description
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-06
Last Modified
2026-02-24
Generated
2026-07-06
AI Q&A
2026-02-06
EPSS Evaluated
2026-07-05
NVD
CVE-2025-13523
EUVD
EUVD-2025-206888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mattermost confluence From 1.0.0 (inc) to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Mitigation Strategies

I don't know

Executive Summary

This vulnerability exists in the Mattermost Confluence plugin versions prior to 1.7.0. It occurs because the plugin fails to properly escape user-controlled display names when rendering HTML templates. As a result, an authenticated Confluence user who sets a malicious display name can craft a specially designed OAuth2 connection link. When a victim visits this link, the attacker's display name is rendered without proper sanitization, allowing the execution of arbitrary JavaScript in the victim's browser.

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks, where arbitrary JavaScript code is executed in the context of the victim's browser. This can result in theft of sensitive information, session hijacking, or performing actions on behalf of the victim without their consent. Since the attack requires an authenticated Confluence user to craft the malicious display name and link, the risk is limited to users who interact with such links.

Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart