Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44179: XWiki Pro Macros allows code execution via page titles

CVE-2026-44179 · published 10 days ago

Summary

Versions 1.13 through 1.14.5 of the XWiki Pro Macros component let a user who can edit a page insert malicious code in a page title or excerpt. When that page is included elsewhere, the malicious code runs with the macro’s permissions, putting the entire XWiki system at risk. Upgrade to version 1.14.5 or later to fix the problem.

What to do

Update xwiki com.xwiki.pro:xwiki-pro-macros to version 1.14.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	xwiki	com.xwiki.pro:xwiki-pro-macros	>= 1.13, < 1.14.5 Fix: upgrade to 1.14.5
–	xwikisas	xwiki-pro-macros	>= 1.13, < 1.14.5

Original advisory text

XWiki Pro Macros: excerpt-include title and content injection executes code

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.

References

https://github.com/advisories/GHSA-w56x-9778-rppx
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44179... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44179 Vendor Advisory
https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e83786... x_refsource_MISC
https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.... x_refsource_MISC
https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-... x_refsource_CONFIRM

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Timeline

Published28 Oct 2026

Updated5 Nov 2026

First seen22 Jun 2026

Sources

GHSA-w56x-9778-rppx · GHSA

CVE-2026-44179 · NVD

CVE-2026-44179 · MITRE

CVE-2026-44179 · OSV

Track software like this

Free during beta