CVE-2025-51990: XWiki · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 4.8 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Aug 2025
Detectable: evidence found.
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should immediately review and restrict administrator access to the XWiki Global Preferences panel, enforcing strong authentication mechanisms such as multi-factor authentication (MFA) to reduce the risk of credential compromise. Administrators should audit the HTTP Meta Info, Footer Copyright, and Footer Version fields for any suspicious or unauthorized content and sanitize or remove any injected scripts. Organizations should implement strict input validation and output encoding controls within their XWiki instances, either by applying vendor patches once available or by deploying web application firewalls (WAFs) with custom rules to detect and block malicious script injections and payloads. Regular monitoring of administrator activities and logs can help detect anomalous behavior indicative of exploitation attempts. Additionally, organizations should educate administrators on secure credential management and phishing awareness to prevent initial access. Where feasible, isolating XWiki instances behind VPNs or restricting access to trusted networks can further reduce exposure. Finally, organizations should stay updated with vendor advisories for official patches and apply them promptly upon release.
Description
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP Meta Info, Footer Copyright, and Footer Version fields. These inputs are stored and subsequently rendered without proper output encoding or sanitization on public-facing pages. As a result, the injected scripts are persistently executed in the browser context of any visitor to the affected instances including both authenticated and unauthenticated users. No user interaction is required beyond visiting a page that includes the malicious content. Successful exploitation can lead to session hijacking, credential theft, unauthorized actions via session riding, or further compromise of the application through client-side attacks. The vulnerability introduces significant risk in any deployment, especially in shared or internet-facing environments where administrator credentials may be compromised.