CVE-2025-66024: XWiki Blog Application UI Vulnerable to Stored XSS via Post Title
Summary
CVE-2025-66024: XWiki Blog Application home page vulnerable to Stored XSS via Post Title. Affects org.xwiki.contrib.blog:application-blog-ui versions < 9.15.7. Fixed in 9.15.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Blog Application is a popular tool that allows users to create and manage blog posts within the XWiki platform. It provides features such as post creation, editing, and commenting, enabling users to share content easily. However, the application has a critical vulnerability that allows attackers to exploit the post title field, leading to potential security risks.
Vulnerability Detail
The vulnerability in the XWiki Blog Application arises from improper handling of user input in the Blog Post Title. Specifically, the title is injected directly into the HTML <title> tag without adequate escaping, allowing an attacker with permissions to create or edit posts to insert malicious JavaScript. This script executes in the browsers of users viewing the blog post, potentially leading to session hijacking or privilege escalation. The vulnerability is classified as Stored Cross-Site Scripting (XSS), which is a significant security concern.
How To Fix
Minimum fixed version
9.15.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is strongly recommended to update to the patched version as soon as possible.
Conclusion
The XWiki Blog Application has a critical Stored XSS vulnerability that can be exploited through the Blog Post Title. Users are advised to update to version 9.15.7 or later to secure their applications. Regular monitoring for vulnerabilities using tools like Vulert is recommended to maintain application security.
See every vulnerability recorded for org.xwiki.contrib.blog:application-blog-ui →
FAQ
Stored XSS is a type of vulnerability where an attacker injects malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground to test your application without any signup.
The potential impacts include session hijacking, where an attacker can take over a user's session, and privilege escalation, where an attacker gains unauthorized access to higher-level permissions.
Yes, the vulnerability affects all users, including administrators, who view the blog post containing the malicious script.
While there are no workarounds available, it is crucial to prioritize updating to the patched version to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.contrib.blog:application-blog-ui.
