XWiki Pro Macros: Code injection in excerpt-include macro

Summary

The excerpt-include macro of the XWiki Pro Macros add-on does not properly escape the title of the included page and executes excerpt content with the rights of the macro. Any user who can edit a page, without script or programming rights, can inject macro syntax that runs when the page is included. Successful exploitation can lead to remote code execution and affects confidentiality, integrity and availability of the whole XWiki installation.

Affected

• xwiki-pro-macros versions from 1.13 up to, but not including, 1.14.5 (per GitHub advisory and OSV)
• A VulDB entry lists 1.14.0 to 1.14.4 only; 1.13.x is not confirmed as unaffected, so treat it as in scope until verified
• The add-on is only relevant where it is installed

Fixed in

• Upgrade to xwiki-pro-macros 1.14.5 or later

Workaround

• Unknown. No workaround is documented by the vendor.
• Interim measures (not from the vendor): restrict page edit rights to trusted users, remove the Confluence macro add-on once migration is finished, and review pages using excerpt-include or excerpt for unexpected macro syntax

Exploitation

• No known exploitation in the wild; not listed in CISA KEV
• Public proof of concept: the GitHub advisory contains reproduction steps using a harmless test string; not independently verified
• The fix has been public since the advisory was published on 2026-06-22

Our recommendation

• Check whether the xwiki-pro-macros add-on is installed and which version is running
• Upgrade to 1.14.5 or later as a high priority if an earlier version is installed
• Until patched, restrict page edit rights to trusted users and review pages for unexpected macro syntax
• If the add-on is not installed, no action is needed

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-w56x-9778-rppx github.com
• GitHub Advisory Database GHSA-w56x-9778-rppx github.com
• Fix commit 151d4fc github.com
• Release xwiki-pro-macros-1.14.5 github.com
• GitLab advisory CVE-2026-44179 advisories.gitlab.com
• VulDB entry 428020 vuldb.com
• Offseq threat radar CVE-2026-44179 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:48.