XWiki Platform versions 10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (CWE-80) in the page revision comparison view. This vulnerability allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser session. The vulnerability is particularly impactful if the victim is an administrator, as it could compromise the entire XWiki instance. While no official patch or remediation level is documented, developers can manually apply a patch to the templates/changesdoc.vm file in the deployed WAR as a workaround.

Successful exploitation of this reflected XSS vulnerability can lead to execution of arbitrary JavaScript in the context of the user's browser. For administrator users, this may result in compromise of the confidentiality, integrity, and availability of the entire XWiki instance. The vulnerability does not require privileges or user interaction beyond visiting a crafted page. There are no known exploits in the wild as of the published date.

No official patch or vendor advisory is provided in the available data. Developers unable to update immediately are advised to manually apply a patch to the templates/changesdoc.vm file in the deployed WAR to mitigate the vulnerability. Users should monitor the vendor's official channels for an official fix and apply updates promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.