CVE-2025-66024
Stored XSS in XWiki Blog Post Title Enables Session Hijacking
Publication date: 2026-03-04
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xwiki | blog_application | to 9.15.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the XWiki blog application versions prior to 9.15.7. It is a Stored Cross-Site Scripting (XSS) issue that occurs because the blog post title is inserted directly into the HTML <title> tag without proper escaping.
An attacker who has permission to create or edit blog posts can inject malicious JavaScript code into the title field. This malicious script will then execute in the browsers of any users who view the blog post, including administrators.
This can lead to session hijacking or privilege escalation. The vulnerability was fixed in version 9.15.7 by adding the missing escaping to the title field.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious JavaScript in the browsers of users who view the affected blog posts.
Such script execution can lead to session hijacking, where attackers steal user session tokens, or privilege escalation, where attackers gain higher access rights than intended.
This can compromise user accounts, including administrator accounts, potentially leading to unauthorized access and control over the XWiki platform.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been patched in the XWiki blog application version 9.15.7 by adding missing escaping to the blog post title.
To mitigate this vulnerability, you should immediately upgrade the XWiki blog application to version 9.15.7 or later.
No known workarounds are available.