CVE-2025-66024
Description
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. No known workarounds are available.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.contrib.blog:application-blog-uiMaven | < 9.15.7 | 9.15.7 |
Affected products
1Patches
1cca87f0a0edcBLOG-245: Improve blog home page escaping
1 file changed · +6 −4
application-blog-ui/src/main/resources/Blog/BlogCode.xml+6 −4 modified@@ -20,7 +20,7 @@ * 02110-1301 USA, or see the FSF site: http://www.fsf.org. --> -<xwikidoc version="1.4" reference="Blog.BlogCode" locale=""> +<xwikidoc version="1.6" reference="Blog.BlogCode" locale=""> <web>Blog</web> <name>BlogCode</name> <language/> @@ -30,9 +30,10 @@ <creationDate>1373016402000</creationDate> <parent>Blog.WebHome</parent> <author>xwiki:XWiki.Admin</author> + <originalMetadataAuthor>XWiki.Admin</originalMetadataAuthor> <contentAuthor>xwiki:XWiki.Admin</contentAuthor> - <date>1749827475000</date> - <contentUpdateDate>1749827475000</contentUpdateDate> + <date>1764057977000</date> + <contentUpdateDate>1764057977000</contentUpdateDate> <version>1.1</version> <title>Macros for the Blog application</title> <comment/> @@ -736,7 +737,8 @@ $!xwiki.jsx.use($blogScriptsDocumentName)## * @param entryObj The xobject of the blog post, an instance of the <tt>Blog.BlogPostClass</tt> xclass. *### #macro(displayEntryTitle $entryDoc $entryObj) - #set($escapedRenderedTitle = $services.rendering.escape($entryDoc.getValue('title'), $xwiki.getCurrentContentSyntaxId())) + ## This is executed in the context of a global HTML macro, so we need to escape html too + #set($escapedRenderedTitle = $escapetool.html($services.rendering.escape($entryDoc.getValue('title'), $xwiki.getCurrentContentSyntaxId()))) #if($doc.fullName == $entryDoc.fullName) (% class="entry-title" %) = $escapedRenderedTitle =
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/xwiki-contrib/application-blog/commit/cca87f0a0edc2e7e049d46d51f4a4d8f78b714banvdPatchWEB
- jira.xwiki.org/browse/BLOG-245nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-h2xq-h7f9-vh6cghsaADVISORY
- github.com/xwiki-contrib/application-blog/security/advisories/GHSA-h2xq-h7f9-vh6cnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-66024ghsaADVISORY
News mentions
0No linked articles in our index yet.