XSS in Xwiki Blog Application
CVE-2025-66024
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. No known workarounds are available.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (28.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Xwiki Blog_application
- Xwiki-contrib Application-blog-ui — versions >= 9.15, < 9.15.7, < 9.15.7
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Exploit, x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-66024?
- CVE-2025-66024 is a critical-severity vulnerability in Xwiki Blog Application, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-03-04.
- How severe is CVE-2025-66024?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2025-66024 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.