8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66024

CVE-2025-66024: XWiki Blog Application home page vulnerable to Stored XSS via Post Title

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66024

CVE-2025-66024:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.contrib.blog:application-blog-ui	maven	< 9.15.7	9.15.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the XWiki Blog Application, where a stored Cross-Site Scripting (XSS) vulnerability was identified in the handling of blog post titles. The root cause of the vulnerability was the improper escaping of the post title before it was rendered inside an HTML <title> tag on the blog's home page. The analysis of the provided patch commit cca87f0a0edc2e7e049d46d51f4a4d8f78b714ba clearly points to the vulnerable code. The file application-blog-ui/src/main/resources/Blog/BlogCode.xml contains a Velocity macro named displayEntryTitle. Before the patch, this macro used $services.rendering.escape to process the title, but this was insufficient as it did not escape characters that have special meaning in HTML. The fix involves wrapping the output with $escapetool.html(), which correctly neutralizes potentially malicious input by escaping it for an HTML context. Therefore, the displayEntryTitle macro is the specific function that processes the malicious input and is the source of the vulnerability.

Vulnerable functions

displayEntryTitle

application-blog-ui/src/main/resources/Blog/BlogCode.xml

The `displayEntryTitle` macro in `Blog/BlogCode.xml` was vulnerable to stored XSS. The blog post title, retrieved using `$entryDoc.getValue('title')`, was escaped for the current content syntax but not for HTML. The patch adds `$escapetool.html()` to properly escape the title before it's rendered within an HTML context, specifically the `<title>` tag. The lack of HTML escaping allowed an attacker to inject arbitrary HTML and script tags into the post title.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.