CVE-2025-52133 Details
Description
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.
A cross-site scripting (XSS) vulnerability has been identified in the XWiki Mocca Calendar application, specifically in versions prior to 2.15. The issue arises during calendar imports, where event titles are not properly escaped. This flaw allows users with view rights on the calendar to execute scripts by importing events with maliciously crafted titles. The vulnerability can be exploited by opening the event page after import, where the script execution occurs.
Users can update to Mocca Calendar version 2.15, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2025CISA-ADP
Assessed Aug 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar | [email protected] | ProductVendor |
| https://github.com/xwiki-contrib/application-mocca-calendar | [email protected] | ProductVendor |
| https://github.com/xwikisas/application-mocca-calendar | [email protected] | ProductVendor |
| https://github.com/xwikisas/application-mocca-calendar/security/advisories/GHSA-mc3x-h7p6-334p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| XWiki Mocca Calendar | <= 2.14.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2025 | New CVE Received | [email protected] |