org.xwiki.platform:xwiki-platform-web-templates Security Analysis
org.xwiki.platform:xwiki-platform-web-templates has 12 known security vulnerabilities in Maven (Java). Upgrade to version 17.8.0-rc-1 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 17.8.0-rc-1
Upgrading to 17.8.0-rc-1 or later resolves all 12 known vulnerabilities in org.xwiki.platform:xwiki-platform-web-templates. Update your pom.xml or build.gradle to version 17.8.0-rc-1.
Is org.xwiki.platform:xwiki-platform-web-templates in your project?
Check if you're affected and upgrade to 17.8.0-rc-1 to stay secure.
Vulnerabilities
12 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2023-45137 XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages | CRITICAL | All versions | 14.10.12, 15.5-rc-1 |
| CVE-2023-45135 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title | CRITICAL | All versions | 14.10.12, 15.5-rc-1 |
| CVE-2023-29512 xwiki-platform-web-templates vulnerable to Eval Injection | CRITICAL | All versions | 13.10.11, 14.4.8, 14.10.1 |
| CVE-2023-45136 XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled | CRITICAL | All versions | 14.10.12, 15.5-rc-1 |
| CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template | CRITICAL | All versions | 14.10.5, 15.1-rc-1 |
| CVE-2023-35159 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template | CRITICAL | All versions | 14.10.5, 15.1-rc-1 |
| CVE-2023-45134 XWiki Platform XSS vulnerability from account in the create page form via template provider | CRITICAL | All versions | 14.10.12, 15.5-rc-1 |
| CVE-2024-41947 XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution | CRITICAL | All versions | 15.10.8, 16.3.0-rc-1 |
| CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template | CRITICAL | All versions | 14.4.8, 14.10.5, 15.1-rc-1 |
| CVE-2023-29207 Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro | HIGH | All versions | 13.10.10, 14.4.6, 14.9 |
| CVE-2025-66472 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication | MEDIUM | All versions | 16.10.10, 17.4.2 |
| CVE-2026-24128 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages | MEDIUM | All versions | 16.10.12, 17.4.5, 17.8.0-rc-1 |
About This Data
Vulnerability data for org.xwiki.platform:xwiki-platform-web-templates is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Maven (Java) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of org.xwiki.platform:xwiki-platform-web-templates.