CVE-2025-46558 is a critical cross-site scripting (XSS) vulnerability affecting XWiki Contrib's Syntax Markdown in versions 8.2 through 8.8. This flaw allows any authenticated user to embed malicious JavaScript within Markdown content, which then executes in the browsers of other users viewing the affected document or comment. With a CVSS score of 9.0 (CRITICAL), the vulnerability has a low attack complexity and can lead to a complete compromise of confidentiality, integrity, and availability if executed by an administrator or user with programming rights. While the vulnerability has been patched in version 8.9, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.2, < 8.9CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.6 Bluesky, 0.3 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.