CVE-2025-66024 is a stored cross-site scripting flaw in the XWiki Blog Application, scored CVSS 9.0 in the NVD record. The post title was put into the page without escaping. Versions from 9.15 up to 9.15.7 are affected, and 9.15.7 fixes it.
What's affected
The GitHub advisory says the Blog Application versions from 9.15 are affected, with 9.15.7 as the patched version. The package is org.xwiki.contrib.blog:application-blog-ui on Maven. The NVD record says versions starting with 9.15 and before 9.15.7. The advisory dates from 4 March 2026 and rates it High, 8.6 on CVSS v4. The project tracks it as BLOG-245.
The cause is that the post title is injected directly into the HTML title element without escaping. A user who can create or edit blog posts can put markup in the title that breaks out of that element and adds script. The script then runs in the browser of anyone who views the post, administrators included.
The advisory says it is not aware of any workaround.
How to check if you're exposed
In your XWiki, open the Extension Manager in the administration area and look for the Blog Application. Read its version. Anything from 9.15 up to but not including 9.15.7 is affected.
Then look at who can create or edit blog posts. The attack needs that permission, so a wiki where many people, or all registered users, can post is more exposed than one where only a few editors can.
Search existing posts for titles that contain angle brackets or the word script, and open suspicious ones in a safe way, such as through the page source view rather than a normal browser render.
What to do now
- Upgrade the Blog Application to 9.15.7 or later through the Extension Manager.
- Review blog posts for titles that contain markup, and fix them. Stored XSS stays in the database after the upgrade.
- Limit the right to create and edit blog posts to trusted users.
- Ask administrators to sign out and back in after you finish.
- Set a Content Security Policy that restricts inline script, to reduce the damage of any injected content.
- Check XWiki core and your other extensions for updates, since stored XSS in one extension can run in the session of a wiki administrator.
Why it matters
The class is CWE-79, cross-site scripting. The data was safe when stored, but it was written into a page in a context that needs escaping, here the head of the document, and the escaping step was missing. The fix, per the advisory, is to add the missing escaping.
The example is easy to overlook. Developers remember to escape the body of a page, but titles also end up in places such as browser tabs, bookmarks, feeds and the head of the document. Every place that prints user supplied text needs the right encoding for that context. A scan of a running site that tries markup in each field finds this kind of gap.
The advisory notes that the script runs for any user who views the post, including administrators. That is the key risk on a wiki: an author with modest rights can reach an administrator's session through nothing more than a blog title. The consequences it lists are session hijacking and privilege escalation. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to clean up after the upgrade?
Yes, check existing posts. The upgrade adds escaping going forward, but a title saved earlier remains in your data and should be reviewed.
Is there a workaround?
The advisory says it is not aware of any workaround.
Sources
Last reviewed: 19 October 2026.
