Description
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.
Remediation
References
Related Vulnerabilities
Django Resource Management Errors Vulnerability (CVE-2015-5963)
WordPress Plugin Rezgo Cross-Site Scripting (1.4.2)
WordPress Plugin Fancy Comments WordPress Cross-Site Scripting (1.2.10)
Apache Tomcat Improper Encoding or Escaping of Output Vulnerability (CVE-2025-31651)
Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2025-62266)