XWiki Platform suffers from a reflected Cross‑Site Scripting flaw that is triggered by specially crafted URLs in error messages. When an authenticated user, particularly one with administrative or programming rights, opens such a URL, malicious script runs in the victim’s browser under the victim’s session. This script can in turn invoke any actions that the victim is authorized to perform, effectively giving the attacker the same level of access to the application. The weakness is identified as CWE‑79 and CWE‑80, indicating that malicious input is accepted and reflected without adequate sanitization.

Vulnerable releases include XWiki Platform versions 7.0‑milestone‑2 through 16.10.11, 17.0.0‑rc‑1 through 17.4.4, and 17.5.0‑rc‑1 through 17.7.0. The affected product is the XWiki Platform (commonly referred to simply as XWiki).

The CVSS base score of 6.5 places the vulnerability in the medium severity range. Exploitation probability as measured by EPSS is under 1 %, indicating that widespread attacks are unlikely but still possible. The flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog. An attacker could exploit this vector by constructing a malicious link and convincing a user with sufficient privileges to click it, enabling them to execute actions with that user’s permissions.