XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

6.5 CVSS

Vulnerability Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66472

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from xwiki

View All →

CVE-2025-66474

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

High 8.7

CVE-2025-66473

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

High 8.7

CVE-2025-58049

XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Medium 5.8

CVE-2025-55749

The XWiki Jetty package (XJetty) allows accessing any application file through URL

High 8.7

CVE-2025-55748

XWiki Platform's configuration files can be accessed through jsx and sx endpoints

Critical 9.3

Affected Vendor

xwiki

View all reports →

Affected Software

xwiki-platform

Vulnerable Versions:

org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10, org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 17.0.0-rc-1, < 17.4.2, org.xwiki.platform:xwiki-platform-web-templates >= 6.2-milestone-1, < 16.10.10, org.xwiki.platform:xwiki-platform-web-templates >= 17.0.0-rc-1, < 17.4.2