The vulnerability originates from the excerpt-include macro in XWiki Remote Macros, which fails to escape titles and renders excerpt content with macro rights. This flaw allows syntax injection that can execute arbitrary macro code. Attackers can exploit the flaw by editing a page and embedding malicious macro syntax in the title or excerpt field, resulting in remote code execution with the macro's permissions. The weakness aligns with CWE-95 and has the potential to compromise confidentiality, integrity, and availability across the entire XWiki instance.

Affected products are the xwikisas:xwiki-pro-macros library, specifically versions starting from 1.13 through 1.14.4. The vulnerability is mitigated in release 1.14.5; earlier releases and any 1.14.x version prior to 1.14.5 remain exposed.

The CVSS base score of 9.9 signifies critical severity, and the EPSS score is not available, indicating limited public data on exploitation. The flaw is not listed in CISA KEV, yet its high severity warrants concern. While the data does not explicitly state the attack vector, the nature of the flaw and its requirement for a page edit context imply a remote exploitation scenario that can be carried out by any user with edit permissions, even without scripting privileges. This allows attackers to compromise the entire installation with minimal prerequisites.