Medium severity · published Feb 12, 2026
CVE-2026-26000
XWiki Platform affected by click-jacking through CSS injection in comments
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
xwiki-platform · xwiki
>= 17.5.0, < 17.9.0; >= 17.0.0-rc-1, < 17.4.6; < 16.10.13 · source: vendor
XW
Xwiki · Xwiki
before 16.10.13; 17.0.0 before 17.4.6; 17.5.0 before 17.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26000
Product
https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg
More from xwiki-platform
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
9.8
CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle