Executive brief
The XWiki Blog Application is vulnerable to a security flaw where malicious code can be hidden within a blog post title. If an attacker creates a post with a specially crafted title, that code will automatically run in the browser of anyone who views the blog, including administrators. This could allow an attacker to steal user sessions, access sensitive data, or take over administrative accounts.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the XWiki Blog Application (org.xwiki.contrib.blog:application-blog-ui) due to improper neutralization of input during web page generation. The blog post title is injected directly into the HTML <title> tag without proper escaping. An attacker with 'create' or 'edit' permissions can inject a payload (e.g., </title><script>...) that executes JavaScript in the context of any user viewing the blog home page. This can lead to session hijacking or privilege escalation. The issue is fixed in version 9.15.7.
Affected products
- XWiki Blog Application UI >= 9.15, < 9.15.7
Timeline
- 2026-03-04: disclosed
- 2026-03-04: advisory
- 2026-03-04: patched