https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:43:12.300715+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-159312 EUVD-2026-159312 2026-10-04T17:43:12.305507+00:00 EUVD-2026-159312 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43401 fkie_cve-2024-43401 2026-10-04T17:43:12.305545+00:00

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.

 https://cve.radiocsirt.org/vuln/ghsa-f963-4cq8-2gw7 GHSA-f963-4cq8-2gw7 — In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them 2026-10-04T17:43:12.305576+00:00

Affected: Maven: org.xwiki.platform:xwiki-platform-web-templates

### Impact

A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time.

### Patches

This vulnerability has been patched in XWiki 15.10RC1.

### Workarounds

No workaround. It is advised to upgrade to XWiki 15.10+.

### References

* https://jira.xwiki.org/browse/XWIKI-20331 * https://jira.xwiki.org/browse/XWIKI-21311 * https://jira.xwiki.org/browse/XWIKI-21481 * https://jira.xwiki.org/browse/XWIKI-21482 * https://jira.xwiki.org/browse/XWIKI-21483 * https://jira.xwiki.org/browse/XWIKI-21484 * https://jira.xwiki.org/browse/XWIKI-21485 * https://jira.xwiki.org/browse/XWIKI-21486 * https://jira.xwiki.org/browse/XWIKI-21487 * https://jira.xwiki.org/browse/XWIKI-21488 * https://jira.xwiki.org/browse/XWIKI-21489 * https://jira.xwiki.org/browse/XWIKI-21490

### For more information

If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported on Intigriti by @floerer

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1880 WID-SEC-W-2024-1880 — xwiki: Mehrere Schwachstellen 2026-10-04T17:43:12.305620+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder beliebigen Programmcode auszuführen.