CVE-2025-53835: XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-14 · updated 2026-06-17
Weakness: CWE-79

Description

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.

Affected products

xwiki-platform: from 5.4.5 before 14.10 — fixed in 14.10

How to fix

Upgrade to a fixed version: xwiki-platform 14.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-53835 or the next vulnerability affects your stack