XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00039.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Xwiki Subscribe
Xwiki-platform Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Xwiki Subscribe
Xwiki-platform Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7vpr-jm38-wr7w XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2 cve-icon cve-icon
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w cve-icon cve-icon
https://jira.xwiki.org/browse/XWIKI-23244 cve-icon cve-icon
History

Thu, 11 Dec 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Xwiki
Xwiki xwiki-platform
Vendors & Products Xwiki
Xwiki xwiki-platform

Thu, 11 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 10 Dec 2025 21:45:00 +0000

Type Values Removed Values Added
Description XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.
Title XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Weaknesses CWE-79
CWE-80
References
Metrics cvssV4_0

{'score': 6.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-12-11T15:40:38.484Z

Reserved: 2025-12-02T15:43:16.586Z

Link: CVE-2025-66472

cve-icon Vulnrichment

Updated: 2025-12-11T15:40:31.699Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-10T22:16:27.687

Modified: 2025-12-12T15:18:13.390

Link: CVE-2025-66472

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-11T16:20:07Z

Weaknesses