THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-66024 (CRITICAL 9.0) — The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected

[NVD] CVE-2025-66024 (CRITICAL 9.0) — The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected

lownvdPublished 2026-03-04

CVE-2025-66024 CVSS: 9.0 CRITICAL Published: 2026-03-04T22:16:11.677

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2025-66024cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-66024