XSS Cross Site Scripting

published 2021-04-20 5 y ago modified 2026-07-08 4 mo ago also GHSA-5c66-v29h-xjh8 , EUVD-2021-0765

cvss: 9.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. The vulnerability has been patched on XWiki 12.8 and 12.6.3.

Patch / fix

fixed in 3

maven org.xwiki.platform:xwiki-platform-oldcore 12.6.3, 12.8
maven org.xwiki.platform:xwiki-platform-web 12.6.3, 12.8
xwiki xwiki 12.6.3, 12.8

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5c66-v29h-xjh8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Affected packages

ecosystem	package	affected	fixed in
maven	org.xwiki.platform:xwiki-platform-oldcore	<12.6.3 >=12.6.4, <12.8	12.6.3 12.8
maven	org.xwiki.platform:xwiki-platform-web	<12.6.3 >=12.6.4, <12.8	12.6.3 12.8

Affected products

xwiki xwiki-platform

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /xwiki/xwiki-platform/security/advisories/GHSA-5c66-v29h-xjh8
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-29459
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary