CVE-2025-53835 – XWiki Rendering Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-53835

Published : July 14, 2025, 11:15 p.m. | 1 hour, 15 minutes ago

Description : XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it’s main purpose is testing and its use is quite difficult, this syntax shouldn’t be installed or used on a regular wiki. There are no known workarounds apart from upgrading.

Severity: 9.0 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…