xwiki-contrib vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20235
3. 20257
4. 20264

Newest CVEs

• CVE-2026-42140

  Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter

  xwiki-contrib · macro-plantuml

  Medium4.4
• CVE-2025-66024

  XWiki Blog Application home page vulnerable to Stored XSS via Post Title

  xwiki-contrib · application-blog-ui

  High8.6
• CVE-2025-65091

  XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

  xwiki-contrib · macro-fullcalendar

  Critical10.0
• CVE-2025-65090

  XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

  xwiki-contrib · macro-fullcalendar

  Medium5.3
• CVE-2025-49594

  XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right

  xwiki-contrib · oidc

  Critical9.2
• CVE-2025-58365

  XWiki Blog Application: Privilege Escalation (PR) from account through blog content

  xwiki-contrib · application-blog

  High8.7
• CVE-2025-52133

  The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.

  xwiki-contrib · Mocca Calendar

  Medium6.4
• CVE-2025-52132

  The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.

  xwiki-contrib · Mocca Calendar

  Medium6.4
• CVE-2025-52131

  The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.

  xwiki-contrib · Mocca Calendar

  Medium6.4
• CVE-2025-46558

  org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

  xwiki-contrib · syntax-markdown

  Critical9.1