CVE-2023-32070: critical vulnerability in xwiki-rendering
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.7%
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-renderingRelated CVEs — xwiki-rendering
In the same product, most dangerous first.
CVE-2025-53837CRITICALorg.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueEPSS 1.5%CVE-2023-37912CRITICALXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroEPSS 1.5%CVE-2023-37908CRITICALorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityEPSS 1.1%CVE-2025-66474HIGHXWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionEPSS 1.1%CVE-2025-53836CRITICALXWiki Rendering is vulnerable to RCE attacks when processing nested macrosEPSS 0.6%CVE-2025-53835CRITICALXWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntaxEPSS 0.4%