XWiki vulnerable to click-jacking through CSS injection in comments

🗓️ 12 Feb 2026 15:54:19Reported by GitHub Advisory DatabaseType

XWiki click-jacking via comments; fixed with untrusted-domain confirmation in 17.9.0, 17.4.6, 16.10.13.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-26000	12 Feb 202620:30	–	attackerkb
BDU FSTEC	The vulnerability of the XWiki platform, a tool for creating collaborative web applications. XWiki allows attackers to execute a type of attack known as CSS Injection.	20 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-26000	12 Feb 202620:40	–	circl
CNNVD	XWiki Platform 安全漏洞	12 Feb 202600:00	–	cnnvd
CVE	CVE-2026-26000	12 Feb 202620:30	–	cve
Cvelist	CVE-2026-26000 XWiki Platform affected by click-jacking through CSS injection in comments	12 Feb 202620:30	–	cvelist
NVD	CVE-2026-26000	12 Feb 202621:16	–	nvd
OSV	CVE-2026-26000 XWiki Platform affected by click-jacking through CSS injection in comments	12 Feb 202620:30	–	osv
OSV	GHSA-74RH-C5RH-88VG XWiki vulnerable to click-jacking through CSS injection in comments	12 Feb 202615:54	–	osv
Positive Technologies	PT-2026-7901	12 Feb 202600:00	–	ptsecurity

Vulners

Node

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg
github	www.github.com/xwiki/xwiki-platform/pull/4645
github	www.github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b
github	www.github.com/xwiki/xwiki-platform/commit/7b5a4f8c34d9b1da3d966e17f7dbccabac448e75
jira	www.jira.xwiki.org/browse/XWIKI-23433
xwiki	www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-26000
github	www.github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6
github	www.github.com/advisories/GHSA-74rh-c5rh-88vg

12 Feb 2026 22:08Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.1

CVSS 45.3

EPSS0.00279

SSVC