CVE-2019-15053

6.8 mediumEPSS 1.3%

Medium (6.8) in atlassian html include and replace macro. EPSS 1.3% chance of exploitation in the next 30 days.

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.

Severity

CVSS 3.0

6.8 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-08-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:html_include_and_replace_macro

References

https://github.com/l0nax/CVE-2019-15053
https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions
https://github.com/l0nax/CVE-2019-15053
https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions

Check your stack JSON