A malformed editing request can be crafted to trigger an XSS flaw in Apache JSPWiki during the error handling phase of the markdown renderer. The vulnerability allows an attacker to inject JavaScript that runs in the victim's browser, which can then harvest sensitive information (such as session cookies or local data) from the targeted user. The weakness is a classic browser‑side injection identified by CWE‑80.

The flaw afflicts Apache JSPWiki versions up to and including 2.12.3. Users of these releases are exposed to the risk. Version 2.12.4 contains the fix and should be deployed where possible.

The CVSS score of 6.5 indicates a medium severity. An exploitation requires only a crafted request that reaches the markdown error path, making the attack vector likely network‑based and achievable by an attacker who can influence content on the wiki. The EPSS score is 0.00252, but the lack of a KEV listing suggests limited active exploitation reports at this time. Nonetheless, the cross‑site scripting nature warrants prompt remediation.