CVE-2025-32974: XSS in XWiki Platform Security

The impact of CVE-2025-32974 is severe. An attacker can leverage this vulnerability to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a wide range of malicious activities, including session hijacking, credential theft, defacement of the XWiki instance, and redirection to malicious websites. The ability to inject scripts into properties that are executed upon editing allows for persistent and stealthy attacks, as the malicious code remains embedded within the page until it is removed. The vulnerability bypasses existing XWiki warnings related to script macros, making it easier for attackers to exploit. Successful exploitation could compromise the entire XWiki installation and potentially affect connected systems.

1. Reserved2025-04-14
2. Published2025-04-29
3. Modified2025-04-30
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32974 is to upgrade XWiki Platform to version 15.10.8 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Carefully review all page properties for suspicious content, particularly those related to text areas or properties that might accept script-like input. Restrict user permissions to the minimum necessary level; avoid granting script, admin, or programming rights to users who do not require them. Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting XWiki. Monitor XWiki logs for unusual activity or attempts to inject malicious scripts. After upgrading, confirm the fix by attempting to create a page with a malicious script in a TextArea property and verifying that the script is not executed when a user with appropriate permissions edits the page.