XWiki Platform versions from 10.4‑rc‑1 to 17.10.0 contain a reflected cross‑site scripting flaw in the page history compare view. An attacker can craft a URL that injects malicious JavaScript when a comparison is rendered, allowing the attacker to run arbitrary code in the victim’s browser. If the victim is an administrator, the malicious script can affect the entire XWiki instance, exposing confidential data, altering site content, or causing denial of service within that hosting environment. This is a typical CWE‑80 vulnerability, where unsanitized user‑supplied input is reflected in the response.

The vulnerability impacts only XWiki Platform, specifically the vendor product xwiki-platform. Affected releases include 10.4‑rc‑1 through 16.10.15, 17.0.0‑rc‑1 through 17.4.7, and 17.5.0‑rc‑1 through 17.10.0. All of these versions expose the vulnerable comparison page; newer releases beyond 17.10.0 contain the fix.

The CVSS score is 6.5, representing a medium severity. EPSS data is missing, so no automated estimation of current exploit likelihood is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred as an unauthenticated or authenticated user clicking a crafted link, with the attacker needing administrative privileges to fully exploit the vulnerability. The flaw is a standard reflected XSS, meaning exploitation typically requires user interaction, but once an admin is affected it can compromise the whole instance.