CVE-2023-26480: XWiki

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.

Affected products

• XWiki XWiki: from 12.10, before 13.10.10 (fixed in 13.10.10); from 14.0, before 14.4.7 (fixed in 14.4.7); from 14.5, before 14.9 (fixed in 14.9); version 14.9 only

Published 2023-03-02. Last modified 2026-06-17.