Xwiki Pro Macros vulnerabilities

CVE-2025-55727 [CRITICAL] CWE-95 CVE-2025-55727: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Conf XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any page or who can access the CKEditor converter. The width parameter is

CVE-2025-55728 [CRITICAL] CWE-95 CVE-2025-55728: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Conf XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax,

CVE-2024-42489 [HIGH] CWE-74 CVE-2024-42489: Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user wi Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.

CVE-2025-65036 [HIGH] CWE-862 CVE-2025-65036: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Conf XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

CVE-2025-65089 [MEDIUM] CWE-862 CVE-2025-65089: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Conf XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.