CVE-2023-26474: XWiki

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.

Affected products

• XWiki XWiki: from 13.10, before 13.10.11 (fixed in 13.10.11); from 14.0, before 14.4.7 (fixed in 14.4.7); from 14.5, before 14.10 (fixed in 14.10)

Published 2023-03-02. Last modified 2026-06-17.