# CVE-2025-13523: Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering

Source: https://junglewise.ai/threats/cve-2025-13523-mattermost-confluence-plugin-doesn-t-properly-escape-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-17  
License: CC BY 4.0 with a link back

CVE-2025-13523 · Severity: low · CVSS 3.1 · Published 2026-02-17

Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence

Technologies: [github.com/mattermost/mattermost-plugin-confluence (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-plugin-confluence). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-13523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13523 being exploited in the wild.

**How severe is CVE-2025-13523?** Low severity, with a CVSS score of 3.1, published 17 February 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-plugin-confluence (Go) SEMVER:introduced=0,fixed=1.7.0.

**Is there a fix for CVE-2025-13523?** Yes. github.com/mattermost/mattermost-plugin-confluence (Go): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-13523?** Check whether you run github.com/mattermost/mattermost-plugin-confluence (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-plugin-confluence (Go): upgrade to 1.7.0 or later

  ```sh
  go get github.com/mattermost/mattermost-plugin-confluence@v1.7.0
  ```


## Affected products

- github.com/mattermost/mattermost-plugin-confluence (Go) SEMVER:introduced=0,fixed=1.7.0

## Identifiers

- CVE-2025-13523
- GHSA-ffx7-34p2-vm3w
- GO-2026-4456

## Related threats

- [Mattermost Confluence Plugin has Improper Validation of Specified Type of Input](https://junglewise.ai/threats/cve-2025-54525-mattermost-confluence-plugin-has-improper-validation-of-specified)
- [Mattermost Confluence Plugin has Missing Authorization vulnerability](https://junglewise.ai/threats/cve-2025-49221-mattermost-confluence-plugin-has-missing-authorization)
- [Mattermost Confluence Plugin is Missing Authentication for Critical Function](https://junglewise.ai/threats/cve-2025-54478-mattermost-confluence-plugin-is-missing-authentication-for)
- [Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions](https://junglewise.ai/threats/cve-2025-53514-mattermost-confluence-plugin-has-improper-check-for-unusual-or)
- [Mattermost Confluence Plugin has Missing Authorization vulnerability](https://junglewise.ai/threats/cve-2025-54458-mattermost-confluence-plugin-has-missing-authorization)