Xwiki-contrib vulnerabilities

Products

• Mocca Calendar 3
• Oidc 3
• Application-admintools 2
• Application-changerequest 2
• Macro-fullcalendar 2

Newest

• xwiki-contrib macro-plantuml Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter CVE-2026-42140 Fix available 4.4 MediumMay 4, 2026
• xwiki blog application, xwiki-contrib application-blog-ui +1 more XWiki Blog Application home page vulnerable to Stored XSS via Post Title CVE-2025-66024 Public exploitFix available 8.6 HighMarch 4, 2026
• xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 more XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService CVE-2025-65091 Fix available 10.0 CriticalJanuary 9, 2026
• xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 more XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService CVE-2025-65090 Fix available 5.3 MediumJanuary 9, 2026
• xwiki-contrib oidc XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right CVE-2025-49594 Fix available 9.2 CriticalOctober 6, 2025
• xwiki-contrib application-blog XWiki Blog Application: Privilege Escalation (PR) from account through blog content CVE-2025-58365 Fix available 8.7 HighSeptember 8, 2025
• xwiki-contrib mocca calendar The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. CVE-2025-52133 6.4 MediumAugust 3, 2025
• xwiki-contrib mocca calendar The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. CVE-2025-52132 6.4 MediumAugust 3, 2025
• xwiki-contrib mocca calendar The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. CVE-2025-52131 6.4 MediumAugust 3, 2025
• xwiki, xwiki-contrib syntax-markdown +1 more org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content CVE-2025-46558 Fix available 9.1 CriticalApril 30, 2025
• atlassian jira The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server CVE-2025-31487 Fix available 7.7 HighApril 3, 2025
• typo3 oidc TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) CVE-2025-24856 Fix available 4.2 MediumJanuary 28, 2025
• xwiki change request, xwiki-contrib application-changerequest +1 more Data leak of password hash through xwiki change request CVE-2023-49280 Fix available 7.7 HighDecember 4, 2023
• xwiki, xwiki-contrib application-admintools +1 more XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries CVE-2023-48293 Fix available 8.8 HighNovember 20, 2023
• xwiki admin tools, xwiki-contrib application-admintools +1 more XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks CVE-2023-48292 Public exploitFix available EPSS 22.9% 9.7 CriticalNovember 20, 2023
• xwiki change request, xwiki-contrib application-changerequest +1 more Change Request Application vulnerable to XSS and remote code execution through change request title CVE-2023-45138 Fix available EPSS 71.7% 10.0 CriticalOctober 12, 2023
• xwiki ckeditor integration, xwiki-contrib application-ckeditor +1 more org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery CVE-2023-22457 Fix available EPSS 19.3% 9.1 CriticalJanuary 4, 2023
• xwiki openid connect, xwiki-contrib oidc +1 more XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication CVE-2022-39387 Fix available 9.1 CriticalNovember 4, 2022