XWiki Pro Macros
CVE-2025-55728
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain account with page-edit rights
-
ExploitInject XWiki syntax into panel macro classes parameter
-
ExecutionUnescaped parameter rendered as script
-
ImpactExecute arbitrary code on XWiki server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated XWiki account with edit permission on at least one page (the description states 'any user who can edit any page'), making this authenticated rather than the PR:N implied by the NVD vector. The specific trigger is the panel macro's 'classes' parameter, which XWiki Pro Macros versions 1.0 through 1.26.4 insert into XWiki 2.1 syntax without escaping (Panel.xml line ~554), enabling syntax injection and resulting script execution. Limiting factors: attacker must possess or acquire edit rights; wikis that restrict editing to trusted users, or that have upgraded to 1.26.5, are not exposed. No special non-default configuration is otherwise needed - the panel macro is a standard feature of the extension. |
| Impact | This is a serious but conditional risk. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) rates it as unauthenticated network RCE, but this directly conflicts with the description, which states exploitation requires 'any user who can edit any page' - a clear privilege prerequisite. CONFLICT STATED EXPLICITLY: CVSS claims PR:N (unauthenticated) yet the vulnerability demonstrably requires an authenticated account with page-edit rights, so the true privilege requirement is PR:L, not PR:N - verify with the GHSA advisory. The source-code evidence (unescaped $classes in Panel.xml rendered as XWiki 2.1 syntax) confirms a genuine code-injection path (CWE-95). Signals are otherwise moderate: EPSS is 3.35% (87th percentile) - elevated but not indicative of mass exploitation; there is no CISA KEV listing and no public exploit identified, so this is not confirmed in-the-wild activity. Net: a legitimately dangerous RCE in multi-user wiki deployments where untrusted users hold edit rights, but the real-world blast radius is tempered by the authentication requirement the raw 9.8 score hides. |
| Exploit ScenarioDerived | An attacker who holds (or phishes/registers for) an account with edit permissions on any wiki page inserts a panel macro whose 'classes' parameter contains crafted XWiki 2.1 syntax. When the page renders, the unescaped parameter is interpreted as script, executing attacker-controlled code on the XWiki server. No public exploit code was identified at time of analysis, though the fixing commit discloses the exact injection point. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Remote code execution in XWiki Pro Macros versions 1.0 through 1.26.4 lets any authenticated user who holds edit permission on a single wiki page break out of the panel macro's 'classes' parameter and inject arbitrary XWiki 2.1 syntax, which the renderer then evaluates with server-side privileges. The flaw is missing output escaping (CWE-95) in XWiki/Macros/Panel.xml, and because injected content executes with the rendering context's rights the assessed impact is scope-changed with high confidentiality, integrity and availability loss (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No public exploit code or CISA KEV entry was identified at time of analysis, but EPSS sits at 3.35% (87th percentile) and a vendor patch (1.26.5) plus public GitHub commit are available, so exposure should be closed quickly on collaborative wikis where edit rights are broadly granted.
Earlier versions of this analysis (1)
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
RemediationAI
Vendor-released patch: XWiki Pro Macros 1.26.5. Upgrade the extension to 1.26.5 (or later) via the XWiki Extension Manager or by replacing the xwiki-pro-macros-ui JAR; the fix is commit 3ca815294bf54fc024b2363efbece7aa08b8efd5, which escapes the 'classes' parameter with $services.rendering.escape($classes, 'xwiki/2.1') before it is used. Details are in the GitHub advisory https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 and JIRA https://jira.xwiki.org/browse/XWIKI-20449. If upgrading must be deferred, the effective compensating control is to deny edit rights on wiki pages to untrusted or unverified accounts (for example by tightening the XWikiRights/XWikiGlobalRights of the affected spaces or by moving to a 'contributors only' publishing model); the trade-off is loss of open collaboration and, in migration projects, the need to import Confluence content through a privileged migration account instead. A second option is to unregister or delete the Panel macro page XWiki.Macros.Panel from the xwiki-pro-macros-ui extension so the vulnerable rendering path is unavailable; the trade-off is that Confluence panel content will no longer render correctly during migration. Because the injection is persisted in page content, also review recently edited pages for suspicious (% class=... or {{script}}/{{velocity}} constructs after the fix is applied, and rotate or review any credentials visible to the XWiki rendering/scripting context in case the flaw was exercised. No vendor patch alternative exists for versions below 1.26.5; the fix version is the authoritative remediation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XWiki Pro Macros (published as xwiki-pro-macros, CPE cpe:2.3:a:xwiki:pro_macros) is a commercial extension supplying Confluence-compatible rendering macros to ease content migration into XWiki; the Panel macro reproduces Confluence's panel container and accepts the Confluence 'classes' parameter for CSS styling. In the vulnerable code the parameter is concatenated directly into an XWiki 2.1 syntax block, (% class="macro-panel $classes" %)((( ... ))), inside XWiki/Macros/Panel.xml (around line 554). Because the value is not escaped before being handed to the XWiki rendering pipeline, an attacker can supply markup that terminates the class attribute and the surrounding macro block and starts new XWiki syntax, including scripting macros. This is the CWE-95 (improper neutralization of directives in dynamically evaluated code, i.e. eval injection) class: untrusted input reaches an interpreter rather than a plain string sink. The supplied fix commit 3ca8152 replaces the raw interpolation with $services.rendering.escape($classes, 'xwiki/2.1') into a $escapedClasses variable, so the parameter is neutralized for the target syntax before rendering. Exploitation requires an authenticated account with edit rights on at least one page (hence PR:L in the assessed vector rather than the PR:N in the NVD record); the scope change (S:C) reflects that injected rendering executes in the wiki's server-side scripting context, not merely in the attacker's page-authoring context.
Know when Xwiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation needs an authenticated editor so PR:L not PR:N; script injection escapes the document context to execute on the server, giving S:C with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.
Executive ViewAI
XWiki Pro Macros versions 1.0 through 1.26.4 expose collaborative wikis to server-side remote code execution by any authenticated user with edit permission on a single page, making broadly editable wikis a critical exposure. Leadership should prioritize remediation because exploitation could compromise the confidentiality, integrity, and availability of the wiki platform and hosted content; no public exploit was identified at time of analysis, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
XWiki Platform allows unauthenticated remote code execution through the SolrSearch endpoint, enabling guests to execute
XWiki Platform prior to specific patched versions contains a CVSS 10.0 remote code execution vulnerability through the u
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated high seve
XWiki is a generic wiki platform. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no aut
Remote code execution in XWiki Pro Macros 1.0 through 1.26.4 allows authenticated users who can edit at least one page o
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated critical
XWiki Commons are technical libraries common to several other top level XWiki projects. Rated critical severity (CVSS 9.
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated critical
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Unauthenticated HQL injection in the XWiki Platform REST search API lets remote attackers inject arbitrary Hibernate Que
Exploit-DB