What is the CVSS score of CVE-2025-53835?

CVE-2025-53835 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Xwiki are affected by CVE-2025-53835?

XWiki instances are vulnerable to cross-site scripting (XSS) attacks that allow authenticated users to inject arbitrary JavaScript code through document editing features available by default.. A patch is available.

How to fix or mitigate CVE-2025-53835?

Within 24 hours: Identify all XWiki instances in your environment and document their current versions. Within 7 days: Upgrade all affected XWiki deployments to version 14.10 or later; prioritize internet-facing or multi-tenant instances first. Within 30 days: Verify patch deployment across all systems, review access logs for suspicious document edits, and reset credentials for users who may have edited documents during the vulnerability window.

Xwiki CVE-2025-53835

EUVD-2025-21399 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2025-07-14 security-advisories@github.com

GHSA-w3wh-g4m9-783p

XSS Xwiki

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21399

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

Patch released

Mar 16, 2026 - 09:43 nvd

Patch available

CVE Published

Jul 14, 2025 - 23:15 nvd

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 maven packages depend on org.xwiki.rendering:xwiki-rendering-syntax-xhtml (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.4.5.

DescriptionGitHub Advisory

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the xdom+xml/current syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the xdom+xml/current syntax from the XHTML syntax. Note that the xdom+xml syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.

AnalysisAI

A cross-site scripting vulnerability in version 5.4.5 and (CVSS 9.0). Critical severity with potential for significant impact on affected systems. Vendor patch is available.