# CVE-2025-13523: mattermost-plugin — Fixed in 1.7.0 🐹 🐹 Go Not in CISA KEV HIGH severity # CVE-2025-13523 — mattermost-plugin-conflue… HIGH CVE-2025-13523 is a high-severity (CVSS 7.7) Cross-site Scripting (XSS) vulnerability in github.com/mattermost/mattermost-plugin-confluence. A fix is available for github.com/mattermost/mattermost-plugin-confluence — see the affected versions and patch details below. Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow Also known as[GHSA-ffx7-34p2-vm3w](/vulnerability/GHSA-ffx7-34p2-vm3w)GO-2026-4456 Published Feb 6, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-13523. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk\-0.00% Lower risk than most CVEs12th percentile — riskier than 12% of all scored CVEsHighest risk 0.00%0.24%0.48%0.72%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐹`github.com/mattermost/mattermost-plugin-confluence` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems. ## Description Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557 ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐹Go `github.com/mattermost/mattermost-plugin-confluence` all versions 1.7.0`go get github.com/mattermost/mattermost-plugin-confluence@v1.7.0` ## Affected Products 1 product · 1 configurations Application `confluence`mattermost ≥ 1.0.0 && < 1.7.0 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/mattermost/mattermost-plugin-confluence, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update github.com/mattermost/mattermost-plugin-confluence to 1.7.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-13523 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557 O3 Security · Impact-Aware SCA ### Is CVE-2025-13523 in your dependencies? Find it across Go, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)