org.xwiki.rendering/xwiki-rendering-syntax-xhtml vulnerabilities

Latest org.xwiki.rendering/xwiki-rendering-syntax-xhtml CVEs

Newest publication first

1. CVE-2025-53835 XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

   Published 2025-07-14

   Critical·CVSS 9.1 EPSS 0.41%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the xdom+xml/current syntax which allows the c...

2. CVE-2023-32070 Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

   Published 2023-05-10

   Medium·CVSS 6.1 EPSS 0.65%

   XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XW...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.