---
id: CVE-2026-44179
title: 'XWiki Pro Macros: excerpt-include title and content injection executes code'
summary: >-
  XWiki Remote Macros provides XWiki rendering macros that are useful when
  migrating content from Confluence. From 1.13 until 1.14.5, the
  `excerpt-include` macro does not properly escape the included page's title and
  executes `excerpt` con…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-95
vendor: xwikisas
product: xwiki-pro-macros
affected:
  - 'xwiki-pro-macros >= 1.13, < 1.14.5'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T15:35:45.630Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-44179'
references:
  - url: >-
      https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx
    label: >-
      https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx
  - url: >-
      https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca
    label: >-
      https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca
  - url: >-
      https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5
    label: >-
      https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5
  - url: 'https://github.com/advisories/GHSA-w56x-9778-rppx'
tags:
  - cve.org
  - ghsa
  - maven
ecosystem: maven
patched:
  - 'com.xwiki.pro:xwiki-pro-macros 1.14.5'
ingestedAt: '2026-06-29T13:24:35.516Z'
---

## Overview

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.

## Affected

- `xwiki-pro-macros >= 1.13, < 1.14.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-44179)

Affected packages:

- `com.xwiki.pro:xwiki-pro-macros >= 1.13, < 1.14.5`

Patched in:

- `com.xwiki.pro:xwiki-pro-macros 1.14.5`

Source: https://github.com/advisories/GHSA-w56x-9778-rppx