CVE-2025-13523
Published: 06 February 2026
Summary
CVE-2025-13523 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Mattermost Confluence. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-13523 is a cross-site scripting vulnerability (CWE-79) affecting the Mattermost Confluence plugin in versions prior to 1.7.0. The flaw arises from the plugin's failure to properly escape user-controlled display names during HTML template rendering, enabling the injection of malicious content.
Authenticated Confluence users with low privileges can exploit this vulnerability by crafting a malicious display name and sharing a specially crafted OAuth2 connection link with victims. When a victim visits the link, the attacker's display name is rendered without sanitization, allowing arbitrary JavaScript execution in the victim's browser. The CVSS v3.1 base score is 7.7 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting network accessibility, high attack complexity, required user interaction, and high impacts on confidentiality and integrity with changed scope.
Mattermost Advisory MMSA-2025-00557 provides details on the issue, with mitigation available via upgrade to Confluence plugin version 1.7.0 or later. Additional guidance is available at https://mattermost.com/security-updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206888
Vulnerability details
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link…
more
that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS vuln directly enables arbitrary JavaScript execution in victim browser (T1059.007) via crafted link; also constitutes exploitation of public-facing web plugin (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and applying the patch to upgrade the Mattermost Confluence plugin to version 1.7.0 or later, which fixes the improper escaping of display names.
Requires validation and sanitization of user-controlled inputs like display names to prevent injection of malicious JavaScript payloads into HTML templates.
Ensures output filtering and proper escaping of display names during HTML rendering to block arbitrary JavaScript execution in victim browsers.