Pro Macros
Monthly
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in XWiki Pro Macros versions 1.0 through 1.26.4 lets any authenticated user who holds edit permission on a single wiki page break out of the panel macro's 'classes' parameter and inject arbitrary XWiki 2.1 syntax, which the renderer then evaluates with server-side privileges. The flaw is missing output escaping (CWE-95) in XWiki/Macros/Panel.xml, and because injected content executes with the rendering context's rights the assessed impact is scope-changed with high confidentiality, integrity and availability loss (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No public exploit code or CISA KEV entry was identified at time of analysis, but EPSS sits at 3.35% (87th percentile) and a vendor patch (1.26.5) plus public GitHub commit are available, so exposure should be closed quickly on collaborative wikis where edit rights are broadly granted.
Remote code execution in XWiki Pro Macros 1.0 through 1.26.4 allows authenticated users who can edit at least one page or access the CKEditor Confluence converter to inject XWiki syntax through the unescaped column macro width parameter. Full RCE occurs only when the extension was installed by a user with programming right; otherwise the injection still executes Velocity code as the wiki admin. Publicly available exploit code exists and EPSS is 6.91% (91st percentile), and the vendor released 1.26.5 to add escaping.
Pro Macros provides XWiki rendering macros. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in XWiki Pro Macros versions 1.0 through 1.26.4 lets any authenticated user who holds edit permission on a single wiki page break out of the panel macro's 'classes' parameter and inject arbitrary XWiki 2.1 syntax, which the renderer then evaluates with server-side privileges. The flaw is missing output escaping (CWE-95) in XWiki/Macros/Panel.xml, and because injected content executes with the rendering context's rights the assessed impact is scope-changed with high confidentiality, integrity and availability loss (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No public exploit code or CISA KEV entry was identified at time of analysis, but EPSS sits at 3.35% (87th percentile) and a vendor patch (1.26.5) plus public GitHub commit are available, so exposure should be closed quickly on collaborative wikis where edit rights are broadly granted.
Remote code execution in XWiki Pro Macros 1.0 through 1.26.4 allows authenticated users who can edit at least one page or access the CKEditor Confluence converter to inject XWiki syntax through the unescaped column macro width parameter. Full RCE occurs only when the extension was installed by a user with programming right; otherwise the injection still executes Velocity code as the wiki admin. Publicly available exploit code exists and EPSS is 6.91% (91st percentile), and the vendor released 1.26.5 to add escaping.
Pro Macros provides XWiki rendering macros. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.