CVE-2023-40176: XWiki Platform stored XSS via time zone user preference

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is a stored XSS reachable by any registered user with a very high EPSS score, though it is not in KEV and requires victim interaction.

What it is

XWiki Platform fails to escape the time zone user preference when rendering a user profile, allowing a stored cross-site scripting payload to be saved through that field. Any registered user can set the value via JavaScript or a crafted save URL, and the payload executes for anyone who views the malicious profile. The flaw has existed since version 4.1M2 and is fixed in 14.10.5 and 15.1RC1.

Impact

An attacker can execute arbitrary script in the browser of any user viewing the profile, stealing session and other data and potentially escalating to programming rights. This can lead to full compromise of the affected XWiki instance.

Attack surface

Reached over the network through the user profile save endpoint; the attacker needs a registered account (low privileges) and the victim must visit the malicious profile (user interaction required). No free-text input is needed because the time zone value can be set directly via JavaScript or a crafted query string.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high (0.79989, 99.6th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade XWiki to 14.10.5 or 15.1RC1 (or later) to apply the official fix.
• If immediate upgrade is not possible, restrict or monitor profile save requests that set the time zone preference to unexpected values.
• Apply output encoding/escaping to the time zone preference rendering as a temporary compensating control.
• Limit the number of accounts with profile creation or editing rights until patched.

Detection

• Search XWiki logs and profile save requests for time zone values containing script tags or HTML/JavaScript characters.
• Monitor for anomalous profile save requests with query strings setting the time zone preference outside the expected dropdown values.
• Review user profiles for stored payloads in the time zone preference field.
• Alert on outbound requests or session anomalies originating from profile pages that could indicate XSS execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.