XWiki Platform allows end‑users to add comments that are stored and rendered as part of the wiki page. An attacker can insert CSS rules into a comment, causing the entire page layout to shift and redirect users to a malicious target when they click on content. The vulnerability is a typical case of CSS injection (CWE‑1021), leading to click‑jacking that can result in phishing, credential theft, or unintended navigation for any user who views the affected page.

All installations of XWiki Platform running versions prior to 17.9.0, 17.4.6, or 16.10.13 are impacted. The issue originates in the comment rendering engine which does not sanitize CSS payloads. Administrators should verify the product version and upgrade if necessary, or disable the ability to embed CSS within comments if an upgrade is not immediately possible.

The CVSS score of 5.3 indicates a moderate level of risk, while the EPSS value of less than 1% points to a low likelihood of widespread exploitation. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires an attacker to post a malicious comment that targets a user who later views the page, which is a likely vector in environments where user comments are publicly accessible. Once triggered, the attack can mislead users into clicking on non‑existent links or deceptive navigation flows, compromising confidentiality of user intent and possibly integrity if additional payloads are used.