Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

INFO

Published Date :

2025-12-10T21:34:47.460Z

Last Modified :

2025-12-11T15:40:38.484Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-66472 vulnerability.

Vendors Products
Xwiki
  • Xwiki-platform
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-66472.

URL Resource
https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2 cve-icon cve-icon
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w cve-icon cve-icon
https://jira.xwiki.org/browse/XWIKI-23244 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability