XWiki Remote Macros vulnerabilities

XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the classes parameter in the panel macro, allowing XWiki syntax injection and remote code execution by any user who can edit any page. Version 1.26.5 contains a patch.

XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the width parameter in the column macro, allowing XWiki syntax injection. This enables remote code execution for users who can edit pages or access the CKEditor converter.

In XWiki Remote Macros prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.