CVE-2025-13523 Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow
Authenticated Confluence users can execute arbitrary JavaScript in victim browsers via malicious display names in the OAuth2 flow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-13523?
CVE-2025-13523 is a high-severity cross-site scripting vulnerability in Mattermost Confluence Plugin, published on 6 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
Weakness: CWE-79
Which versions are affected by CVE-2025-13523?
3 open source packages ship an affected version, including github.com/mattermost/mattermost-plugin-confluence. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mattermost/mattermost-plugin-confluence Go | All versions | 1.7.0 |
github.com/mattermost/mattermost-plugin-confluence Go | All versions | 1.7.0 |
github.com/mattermost/mattermost-plugin-confluence Go | All versions | 1.7.0 |
Products include Mattermost Confluence.
How do I fix CVE-2025-13523?
Upgrade github.com/mattermost/mattermost-plugin-confluence to 1.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-13523 being exploited?
There is no known exploitation of CVE-2025-13523 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Confluence Plugin
- CVE-2025-52931 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
- CVE-2025-54525 Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
- CVE-2025-44004 Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
- CVE-2025-54478 Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin
- CVE-2025-48731 Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin
Sources
Also known as GHSA-ffx7-34p2-vm3w, GO-2026-4456.