Medium severity6.1NVD Advisory· Published Dec 10, 2025· Updated Jun 17, 2026

CVE-2025-66472

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesMaven	>= 6.2-milestone-1, < 16.10.10	16.10.10
org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesMaven	>= 17.0.0-rc-1, < 17.4.2	17.4.2
org.xwiki.platform:xwiki-platform-web-templatesMaven	>= 6.2-milestone-1, < 16.10.10	16.10.10
org.xwiki.platform:xwiki-platform-web-templatesMaven	>= 17.0.0-rc-1, < 17.4.2	17.4.2

Affected products

Cryptpad/Xwiki
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Range: >=6.2,<16.10.10
ghsa-coords2 versions
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin-resources pkg:maven/org.xwiki.platform/xwiki-platform-web-templates
>= 6.2-milestone-1, < 16.10.10+ 1 more
- (no CPE)range: >= 6.2-milestone-1, < 16.10.10
- (no CPE)range: >= 6.2-milestone-1, < 16.10.10
Cryptpad/Xwiki Platformv5
Range: org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10

Patches

Vulnerability mechanics

References

github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2nvdPatchWEB
github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7wnvdPatchVendor AdvisoryWEB
jira.xwiki.org/browse/XWIKI-23244nvdExploitIssue TrackingVendor AdvisoryWEB
github.com/advisories/GHSA-7vpr-jm38-wr7wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-66472ghsaADVISORY

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.1/ 10

CVSS v46.5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected

Source repo: github.com/xwiki/xwiki-platform

EPSS

Probability of exploitation in the next 30 days.

0.52%

VYPR risk score

Composite of severity, exploitation, and reach.

0.33medium

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE ID

CVE-2025-66472