XWiki Platform versions from 10.4‑rc‑1 to 17.10.0 contain a reflected cross‑site scripting flaw in the page history compare view. An attacker can craft a URL that injects malicious JavaScript when a comparison is rendered, allowing the attacker to run arbitrary code in the victim’s browser. If the victim is an administrator, the malicious script can affect the entire XWiki instance, exposing confidential data, altering site content, or causing denial of service within that hosting environment. This is a typical CWE‑80 vulnerability, where unsanitized user‑supplied input is reflected in the response.

The vulnerability impacts only XWiki Platform, specifically the vendor product xwiki-platform. Affected releases include 10.4‑rc‑1 through 16.10.15, 17.0.0‑rc‑1 through 17.4.7, and 17.5.0‑rc‑1 through 17.10.0. All of these versions expose the vulnerable comparison page; newer releases beyond 17.10.0 contain the fix.

The CVSS score is 6.5, representing a medium severity. The EPSS score of 2% indicates a low but non‑negligible likelihood of exploitation, consistent with the vulnerability’s medium risk. The vulnerability is not listed in CISA KEV. The attack vector is inferred as an unauthenticated or authenticated user clicking a crafted link; an attacker requires administrative privileges to fully compromise the entire instance. The flaw is a standard reflected XSS, meaning exploitation typically requires user interaction.