XWiki Pro Macros CVE-2025-55727

Requires an authenticated account that can edit at least one page OR can access the CKEditor Confluence converter; the attacker then supplies a column macro width parameter containing XWiki syntax, which is rendered unescaped (CWE-95). Impact severity is gated by install context: full RCE occurs only when the Pro Macros extension was installed by a user holding programming right; absent that, the injection still executes Velocity code as the wiki admin. Limiting factors: valid low-privilege credentials are needed (not anonymous), XWiki Pro Macros versions 1.0 through 1.26.4 must be installed, and upgrading to 1.26.5 (which escapes the width via $services.rendering.escape) removes the condition.

Signals are mostly aligned toward real but access-gated risk. CWE-95 (eval injection) via the unescaped width parameter in the column macro yields XWiki-syntax injection and RCE, consistent with the CVSS 9.8 (C:H/I:H/A:H). Publicly available exploit code exists (the GHSA-hxqp-983c-m8h9 advisory details the injection), and EPSS of 6.91% at the 91st percentile indicates above-average but not extreme near-term exploitation probability; there is no CISA KEV listing, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. The most important conflict: the input CVSS vector is AV:N/AC:L/PR:N/UI:N (unauthenticated), but the description explicitly scopes exploitation to 'any user who can edit any page or who can access the CKEditor converter' - that is an authenticated, low-privilege precondition, so PR:N appears overstated and should be verified with the vendor advisory. Full RCE further depends on the macro having been installed by a user with programming right; otherwise impact is limited to executing Velocity code as the wiki admin, which is still severe. Net: a genuine priority for organizations running the XWiki Pro Macros add-on, but the realistic bar is a logged-in user, not an anonymous internet attacker, which tempers the raw 9.8.

An authenticated user with page-edit rights (or access to the CKEditor Confluence converter) inserts a column macro whose width parameter contains crafted XWiki syntax. Because the width is emitted without escaping, the injected syntax is interpreted by the rendering engine, executing Velocity/script code with the rights of the macro installer - up to full remote code execution when that installer held programming right. Public exploit detail is available in the GitHub Security Advisory.