{"action":"Upgrade org.xwiki.platform:xwiki-platform-web-templates to 16.10.12 (16.10.x), 17.4.5 (17.4.x) or 17.8.0-rc-1 (17.8.x) or later.","affected":[{"fixed":"16.10.12","introduced":"7.0-milestone-2"},{"fixed":"17.4.5","introduced":"17.0.0-rc-1"},{"fixed":"17.8.0-rc-1","introduced":"17.5.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-web-templates","cve_ids":["CVE-2026-24128"],"ecosystem":"Maven","epss":0.00551,"exploited":false,"fixed_versions":["16.10.12","17.4.5","17.8.0-rc-1"],"ghsa_id":"GHSA-wvqx-m5px-6cmp","id":"tcs_01M5N9H7T5F4GRAVSVFTN8HE2M","modified_at":"2026-02-03T03:07:15.865116Z","published_at":"2026-01-23T16:28:44Z","references":["https://osv.dev/vulnerability/GHSA-wvqx-m5px-6cmp","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp","https://nvd.nist.gov/vuln/detail/CVE-2026-24128","https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf","https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71","https://github.com/xwiki/xwiki-platform","https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12","https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5","https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1","https://jira.xwiki.org/browse/XWIKI-23462"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-wvqx-m5px-6cmp","url":"https://osv.dev/vulnerability/GHSA-wvqx-m5px-6cmp"},{"source":"nvd","source_id":"CVE-2026-24128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24128"}],"summary":"XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages"}