org.xwiki.rendering vulnerabilities

Products

• org.xwiki.rendering/xwiki-rendering-xml 3
• org.xwiki.rendering/xwiki-rendering-syntax-xhtml 2
• org.xwiki.rendering/xwiki-rendering-macro-footnotes 1
• org.xwiki.rendering/xwiki-rendering-syntax-annotatedhtml5 1
• org.xwiki.rendering/xwiki-rendering-syntax-annotatedxhtml 1
• org.xwiki.rendering/xwiki-rendering-syntax-html 1
• org.xwiki.rendering/xwiki-rendering-syntax-html5 1
• org.xwiki.rendering/xwiki-rendering-transformation-macro 1

Latest org.xwiki.rendering CVEs

Newest publication first

1. CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

   Published 2026-09-18

   Critical·CVSS 9.9 EPSS 1.5%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary...

2. CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

   Published 2025-12-10

   High·CVSS 8.7 EPSS 1.1%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/htm...

3. CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros

   Published 2025-07-14

   High·CVSS 8.8 EPSS 0.64%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't p...

4. CVE-2025-53835 XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

   Published 2025-07-14

   Critical·CVSS 9.1 EPSS 0.41%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the xdom+xml/current syntax which allows the c...

5. CVE-2023-37912 XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro

   Published 2023-10-25

   High·CVSS 8.8 EPSS 1.5%

   XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of org.xwiki.platform:xwiki-core-rendering-macro-footnotes and org.xwiki.platform:xwiki-rendering-macro-footnotes and prior to version 15.1-rc...

6. CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

   Published 2023-10-25

   Critical·CVSS 9.6 EPSS 1.1%

   XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via inva...

7. CVE-2023-32070 Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

   Published 2023-05-10

   Medium·CVSS 6.1 EPSS 0.65%

   XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XW...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.