CVE-2025-65036: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from…

PriorityP353high8.3CVSS 3.1

AVNACLPRLUINSUCHIHAL

EPSS

0.33%

25.2th percentile

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
xwiki	pro_macros	< 1.27.1	1.27.1
xwikisas	xwiki-pro-macros	< 1.27.1	1.27.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.