Read the docs
TI-2022-16521 Aliases CVE-2022-36098GHSA-c5v8-2q4r-5w9v

XWiki Platform Mentions UI vulnerable to Cross-site Scripting

Priority HIGH 79CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.71607 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed xwiki-platform (xwiki): 13.10.6, 14.4org.xwiki.platform:xwiki-platform-mentions-ui (Maven): 13.10.6, 14.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform12.5-rc-1 to before 13.10.6; 14.0 to before 14.413.10.6, 14.4Patch availableCNA
—org.xwiki.platform:xwiki-platform-mentions-ui (Maven)12.5-rc-1 to before 13.10.613.10.6Patch availableGHSA-c5v8-2q4r-5w9v
—org.xwiki.platform:xwiki-platform-mentions-ui (Maven)14.0 to before 14.414.4Patch availableGHSA-c5v8-2q4r-5w9v
  • xwiki-platform VendorXWiki Affected 12.5-rc-1 to before 13.10.6; 14.0 to before 14.4 Fixed in 13.10.6, 14.4 Patch available CNA
  • org.xwiki.platform:xwiki-platform-mentions-ui (Maven) Vendor— Affected 12.5-rc-1 to before 13.10.6 Fixed in 13.10.6 Patch available GHSA-c5v8-2q4r-5w9v
  • org.xwiki.platform:xwiki-platform-mentions-ui (Maven) Vendor— Affected 14.0 to before 14.4 Fixed in 14.4 Patch available GHSA-c5v8-2q4r-5w9v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*12.5 to before 13.10.6; 14.0 to before 14.4VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 12.5 to before 13.10.6; 14.0 to before 14.4 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 13.10.6, 14.4
  • Fix · GHSA-c5v8-2q4r-5w9v org.xwiki.platform:xwiki-platform-mentions-ui (Maven) Fixed in 13.10.6 Advisory →
  • Fix · GHSA-c5v8-2q4r-5w9v org.xwiki.platform:xwiki-platform-mentions-ui (Maven) Fixed in 14.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36098
  2. 2026-10-03 Alias added: GHSA-c5v8-2q4r-5w9v

References

Exploit 2

Patch 2

Advisory 1

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences