All vulnerabilities
CVE-2026-44179GHSA-w56x-9778-rppx

xwiki-pro-macros: XWiki Pro Macros: excerpt-include title and content injection executes code

xwikisas xwiki-pro-macrosMavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.14.5Fixed versionOSV
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 1.14.5com.xwiki.pro:xwiki-pro-macros, MavenOSV<dependency><groupId>com.xwiki.pro</groupId><artifactId>xwiki-pro-macros</artifactId><version>1.14.5</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml and the rendering of excerpt content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or excerpt and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.

Text from CVE List

Affected versions 2

  • xwiki-pro-macrosaffected: >= 1.13, < 1.14.5CVE List
  • com.xwiki.pro:xwiki-pro-macros, Mavenfrom 1.13, fixed in 1.14.5OSV

References 3