CVE-2025-65036 HIGH

CVE-2025-65036: XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

Vendor Xwikisas
Product xwiki-pro-macros
Weakness CWE-862 · Missing authorization
Published December 5, 2025
Last update December 5, 2025
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

Key dates

02Disclosure timeline

December 5, 2025 CVE published
December 5, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-0679 Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset CVE-2025-15510 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2022-39113 CVE-2023-2714 Groundhogg <= 2.7.9.8 - Missing Authorization to Update License