XWiki Platform Mentions UI vulnerable to Cross-site Scripting
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-36098
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 23:06 UTC · Revision 1
Source evidence
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
core-osv · Original sourcePublished 8 Sept 2022, 20:50 UTC
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
osv:CVE-2022-36098
Complete source record
{
"id": "18d88915ebc7fb6e5137251ffd898e93f36c59af7164ba60906a91453923515b",
"url": "https://osv.dev/vulnerability/CVE-2022-36098",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "XWiki Platform Mentions UI vulnerable to Cross-site Scripting",
"summary": "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
"evidence": "osv:CVE-2022-36098",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-36098",
"aliases": [
"CVE-2022-36098",
"GHSA-c5v8-2q4r-5w9v"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "9c0539e3b1f7a819bfbf4914fc05788308a4f7d0"
},
{
"fixed": "479a47aeb015f634a121f1821642e0cb61dcc3d7"
},
{
"introduced": "491547c4f74b9be58123ef22081ae7e6840a11c7"
},
{
"fixed": "17d3df2f9d5cf80b652df565e0c7533e0404fc0d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.5"
},
{
"fixed": "13.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0"
},
{
"fixed": "14.4"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "5e4e15c6a4653d53cc34657cebd5e2989e3694de"
},
{
"fixed": "c3f97150d6997ada95d919857fdc9690ed7ed316"
},
{
"introduced": "d971304b0e0bf4f6dad278de89518edc17459741"
},
{
"fixed": "5d23a4d1ec341678fa8f1c2ac60d50f0a16f5e3b"
},
{
"fixed": "4032dc896857597efd169966dc9e2752a9fdd459"
},
{
"fixed": "4f290d87a8355e967378a1ed6aee23a06ba162eb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.5"
},
{
"fixed": "13.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0"
},
{
"fixed": "14.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4032dc896857597efd169966dc9e2752a9fdd459"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "4f290d87a8355e967378a1ed6aee23a06ba162eb"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36098.json"
}
}
],
"modified": "2026-10-28T02:30:24.157172679Z",
"provider": "osv",
"references": [
"https://jira.xwiki.org/browse/XWIKI-19752",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json",
"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
"https://nvd.nist.gov/vuln/detail/CVE-2022-36098",
"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json"
}
},
"related_cves": [
{
"value": "CVE-2022-36098",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490733,
"published_at": "2022-09-08T20:50:11+00:00"
}