ByteOS

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 6.08%

||

7 Day CHG-0.00%

Published-07 Jul, 2025 | 15:13

Updated-08 Jul, 2025 | 16:18

ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages

The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped. This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - ApprovedRevs extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-7057

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 6.08%

||

7 Day CHG-0.00%

Published-07 Jul, 2025 | 15:12

Updated-10 Jul, 2025 | 23:22

Stored XSS in Quiz

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension allows Stored XSS.This issue affects Mediawiki - Quiz Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - Quiz Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53486

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 11.69%

||

7 Day CHG+0.01%

Published-07 Jul, 2025 | 15:07

Updated-08 Jul, 2025 | 16:18

WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser function

The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escaping. An attacker can inject JavaScript event handlers such as onmouseenter using carefully crafted input via the {{#tag:tagcloud}} parser function, resulting in arbitrary JavaScript execution when a victim hovers over a link in the category cloud. The vulnerability exists because the linkstyle parameter is only passed through Sanitizer::checkCss() (which does not escape HTML) and is then directly inserted into a style attribute using string concatenation instead of Html::element or Html::openElement. This issue affects Mediawiki - WikiCategoryTagCloud extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - WikiCategoryTagCloud extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-7056

CVSS Score-6.3||MEDIUM

EPSS-0.03% / 8.15%

||

7 Day CHG-0.00%

Published-07 Jul, 2025 | 13:57

Updated-10 Jul, 2025 | 23:28

Stored XSS in UrlShortener

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Extension allows Stored XSS.This issue affects Mediawiki - UrlShortener Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - UrlShortener Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53485

CVSS Score-7.5||HIGH

EPSS-0.04% / 11.38%

||

7 Day CHG-0.00%

Published-04 Jul, 2025 | 17:39

Updated-08 Jul, 2025 | 18:15

SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes

SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - SecurePoll extension

CWE ID-CWE-862

Missing Authorization

CVE-2025-53484

CVSS Score-9.8||CRITICAL

EPSS-0.06% / 17.54%

||

7 Day CHG-0.00%

Published-04 Jul, 2025 | 17:34

Updated-08 Jul, 2025 | 18:15

SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input

User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - SecurePoll extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53483

CVSS Score-8.8||HIGH

EPSS-0.02% / 4.43%

||

7 Day CHG-0.00%

Published-04 Jul, 2025 | 17:28

Updated-08 Jul, 2025 | 18:15

SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery

ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - SecurePoll extension

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2025-53482

CVSS Score-6.1||MEDIUM

EPSS-0.03% / 6.16%

||

7 Day CHG-0.00%

Published-04 Jul, 2025 | 16:01

Updated-08 Jul, 2025 | 18:15

IPInfo: Message key XSS through several IPInfo messages in infobox and popup

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - IPInfo Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53481

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.20%

||

7 Day CHG-0.00%

Published-04 Jul, 2025 | 15:47

Updated-08 Jul, 2025 | 18:15

Denial of service vector on ipinfo/v0/norevision

Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - IPInfo Extension

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2025-6926

CVSS Score-8.8||HIGH

EPSS-0.07% / 21.91%

||

7 Day CHG-0.03%

Published-03 Jul, 2025 | 16:23

Updated-03 Nov, 2025 | 20:19

Security Authentication Bypass in CentralAuth

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Product-Mediawiki - CentralAuth Extension

CWE ID-CWE-287

Improper Authentication

CVE-2025-53500

CVSS Score-5.6||MEDIUM

EPSS-0.09% / 25.25%

||

7 Day CHG-0.00%

Published-03 Jul, 2025 | 16:17

Updated-30 Sep, 2025 | 20:26

Stored XSS in MassEditRegex

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Extension allows Stored XSS.This issue affects Mediawiki - MassEditRegex Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Vendor-malvineous Wikimedia Foundation

Product-mediawiki masseditregex Mediawiki - MassEditRegex Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53501

CVSS Score-8.8||HIGH

EPSS-0.10% / 26.94%

||

7 Day CHG-0.00%

Published-03 Jul, 2025 | 16:15

Updated-01 Oct, 2025 | 14:17

Content Access Bypass in Scribunto

Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Vendor-xtex Wikimedia Foundation

Product-scribunto mediawiki Mediawiki - Scribunto Extension

CWE ID-CWE-284

Improper Access Control

CVE-2025-53502

CVSS Score-6.5||MEDIUM

EPSS-0.06% / 17.82%

||

7 Day CHG-0.00%

Published-03 Jul, 2025 | 16:11

Updated-10 Jul, 2025 | 23:37

HTML injection in FeaturedFeeds

Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.

Product-Mediawiki - FeaturedFeeds Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-53489

CVSS Score-5.6||MEDIUM

EPSS-0.06% / 19.71%

||

7 Day CHG-0.00%

Published-03 Jul, 2025 | 16:06

Updated-01 Oct, 2025 | 13:20

XSS in GoogleDocs4MW

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Vendor-jackphoenix Wikimedia Foundation

Product-mediawiki googledocs4mw Mediawiki - GoogleDocs4MW Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53490

CVSS Score-5.6||MEDIUM

EPSS-0.06% / 19.71%

||

7 Day CHG-0.00%

Published-03 Jul, 2025 | 16:04

Updated-01 Oct, 2025 | 13:19

Multiple XSS in CampaignEvents

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - CampaignEvents Extension: from 1.43.X before 1.43.2.

Vendor-jly Wikimedia Foundation

Product-campaignevents mediawiki Mediawiki - CampaignEvents Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53492

CVSS Score-3.7||LOW

EPSS-0.04% / 12.61%

||

7 Day CHG~0.00%

Published-02 Jul, 2025 | 14:41

Updated-26 Sep, 2025 | 16:55

Stored XSS in MintyDocs

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.

Vendor-yaronkoren Wikimedia Foundation

Product-mintydocs mediawiki Mediawiki - MintyDocs Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53493

CVSS Score-6.5||MEDIUM

EPSS-0.08% / 23.08%

||

7 Day CHG~0.00%

Published-02 Jul, 2025 | 14:38

Updated-26 Sep, 2025 | 17:01

Stored XSS in MintyDocs

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.

Vendor-yaronkoren Wikimedia Foundation

Product-mintydocs mediawiki Mediawiki - MintyDocs Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-53494

CVSS Score-6.5||MEDIUM

EPSS-0.08% / 23.08%

||

7 Day CHG~0.00%

Published-02 Jul, 2025 | 14:24

Updated-30 Sep, 2025 | 20:33

Stored XSS in TwoColConflict

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Vendor-wmde-fisch Wikimedia Foundation

Product-twocolconflict mediawiki Mediawiki - TwoColConflict Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-32077

CVSS Score-6.9||MEDIUM

EPSS-0.39% / 59.19%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:25

Updated-15 Apr, 2025 | 18:39

XSSes in Extension:SimpleCalendar

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.

Product-Mediawiki - Extension:SimpleCalendar

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32078

CVSS Score-6.9||MEDIUM

EPSS-0.39% / 59.19%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:24

Updated-15 Apr, 2025 | 18:39

XSSes and potential RCE in Special:VersionCompare

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.

Product-Mediawiki - Version Compare Extension

CWE ID-CWE-116

Improper Encoding or Escaping of Output

CVE-2025-32079

CVSS Score-6.5||MEDIUM

EPSS-0.28% / 51.39%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:24

Updated-07 Jul, 2025 | 15:15

Saving the right content to MediaWiki:GrowthMentors.json can take down the site

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.

Product-Mediawiki - GrowthExperiments

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32080

CVSS Score-6.9||MEDIUM

EPSS-0.36% / 57.92%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:24

Updated-15 Apr, 2025 | 18:39

Cross-origin data leak in mobilefrontend via lazy load images

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

Product-Mediawiki - Mobile Frontend Extension

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-32076

CVSS Score-6.9||MEDIUM

EPSS-0.39% / 59.19%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:23

Updated-15 Apr, 2025 | 18:39

Evil regex used to process user-provided data in VisualData

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

Product-Mediawiki - Visual Data Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32072

CVSS Score-6.9||MEDIUM

EPSS-0.45% / 63.29%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:23

Updated-03 Nov, 2025 | 20:18

HTML injection in feed output from i18n message

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.

Product-Mediawiki Core - Feed Utils

CWE ID-CWE-116

Improper Encoding or Escaping of Output

CVE-2025-32073

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:22

Updated-07 Jul, 2025 | 14:15

System message XSS in HTMLTags

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43.

Product-Mediawiki - HTML Tags

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32074

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:22

Updated-07 Jul, 2025 | 15:15

XSSes in Extension:ConfirmAccount

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43.

Product-Mediawiki - Confirm Account Extension

CWE ID-CWE-116

Improper Encoding or Escaping of Output

CVE-2025-32075

CVSS Score-6.9||MEDIUM

EPSS-0.39% / 59.19%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:21

Updated-15 Apr, 2025 | 18:39

IP and user agent leaks in Extension:Tabs

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

Product-Mediawiki - Tabs Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32067

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:21

Updated-07 Jul, 2025 | 15:15

i18n XSS vulnerability in message growthexperiments

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43.

Product-Mediawiki - Growth Experiments Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32068

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 36.06%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:21

Updated-07 Jul, 2025 | 15:15

Revoking authorization of OAuth2 consumer does not invalidate refresh tokens

Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.

Product-Mediawiki - OAuth Extension

CWE ID-CWE-863

Incorrect Authorization

CVE-2025-32069

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:20

Updated-07 Jul, 2025 | 14:15

Wikitext stored XSS on filepages due to dangerous WBMI serialization

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.

Product-Mediawiki - Wikibase Media Info Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32070

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:20

Updated-07 Jul, 2025 | 15:15

XSSes in AJAXPoll

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43.

Product-Mediawiki - AJAX Poll Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32071

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.71%

||

7 Day CHG~0.00%

Published-11 Apr, 2025 | 16:19

Updated-07 Jul, 2025 | 15:15

Wikibase CommonsInlineImageFormatter: i18n XSS

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Extension: from 1.39 through 1.43.

Product-Mediawiki - Wikidata Extension

CWE ID-CWE-20

Improper Input Validation

CVE-2025-32700

CVSS Score-2.3||LOW

EPSS-0.48% / 64.52%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:31

Updated-11 Apr, 2025 | 15:39

AbuseFilter log interfaces expose global private and hidden filters when central DB is not available

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue affects AbuseFilter: from >= 1.43.0 before 1.43.1.

Product-MediaWiki

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-32699

CVSS Score-2.1||LOW

EPSS-0.33% / 55.27%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:30

Updated-03 Nov, 2025 | 20:18

Potential javascript injection attack enabled by Unicode normalization in Action API

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

Product-MediaWiki Parsoid

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-32698

CVSS Score-2.1||LOW

EPSS-0.48% / 64.52%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:29

Updated-03 Nov, 2025 | 20:18

LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Product-MediaWiki

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-32697

CVSS Score-Not Assigned

EPSS-0.26% / 48.84%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:29

Updated-11 Apr, 2025 | 15:39

Cascading protection is not preventing file reversions

Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php. This issue affects MediaWiki: before 1.42.6, 1.43.1.

Product-MediaWiki

CWE ID-CWE-281

Improper Preservation of Permissions

CVE-2025-32696

CVSS Score-Not Assigned

EPSS-0.27% / 50.33%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:28

Updated-03 Nov, 2025 | 20:18

"reupload-own" restriction can be bypassed by reverting file

Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Product-MediaWiki

CWE ID-CWE-281

Improper Preservation of Permissions

CVE-2025-3469

CVSS Score-Not Assigned

EPSS-0.44% / 62.46%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 18:28

Updated-03 Nov, 2025 | 20:18

i18n XSS vulnerability in HTMLMultiSelectField when sections are used

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Product-MediaWiki

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-23074

CVSS Score-2.4||LOW

EPSS-0.09% / 25.50%

||

7 Day CHG~0.00%

Published-14 Jan, 2025 | 18:58

Updated-31 Jan, 2025 | 17:15

Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Product-Mediawiki - SocialProfile Extension

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-23073

CVSS Score-3.5||LOW

EPSS-0.08% / 22.91%

||

7 Day CHG~0.00%

Published-14 Jan, 2025 | 18:45

Updated-16 Oct, 2025 | 23:15

API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data. This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extension.

Product-Mediawiki - GlobalBlocking Extension

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVE-2025-23072

CVSS Score-5.4||MEDIUM

EPSS-0.08% / 24.62%

||

7 Day CHG~0.00%

Published-14 Jan, 2025 | 18:29

Updated-13 Mar, 2025 | 19:15

XSS in Special:RefreshSpecial

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - RefreshSpecial Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Product-Mediawiki - RefreshSpecial Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-23081

CVSS Score-6.1||MEDIUM

EPSS-0.08% / 24.35%

||

7 Day CHG~0.00%

Published-14 Jan, 2025 | 16:56

Updated-13 Mar, 2025 | 15:15

Various security vulnerabilities in Extension:DataTransfer

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Product-Mediawiki - DataTransfer Extension

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-23080

CVSS Score-5.3||MEDIUM

EPSS-0.11% / 30.11%

||

7 Day CHG~0.00%

Published-14 Jan, 2025 | 16:40

Updated-14 Jan, 2025 | 18:16

XSSes in Special:BadgeView

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Product-Mediawiki - OpenBadges Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-23079

CVSS Score-6.1||MEDIUM

EPSS-0.08% / 24.62%

||

7 Day CHG~0.00%

Published-10 Jan, 2025 | 19:03

Updated-13 Jan, 2025 | 18:15

XSSes in Extension:ArticleFeedbackv5

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2.

Product-Mediawiki - ArticleFeedbackv5 extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-23078

CVSS Score-6.5||MEDIUM

EPSS-0.11% / 30.11%

||

7 Day CHG~0.00%

Published-10 Jan, 2025 | 17:57

Updated-13 Jan, 2025 | 19:15

XSS in BreadCrumbs2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.5, from 1.42.X before 1.42.4.

Product-Mediawiki - Breadcrumbs2 extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47841

CVSS Score-6.9||MEDIUM

EPSS-21.58% / 95.58%

||

7 Day CHG-4.52%

Published-05 Oct, 2024 | 01:02

Updated-16 Oct, 2024 | 16:34

Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

Product-wikimedia-extensions-css Mediawiki - CSS Extension mediawiki-extensions-css

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2024-47840

CVSS Score-6.9||MEDIUM

EPSS-0.49% / 64.83%

||

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:53

Updated-16 Oct, 2024 | 16:44

Stored XSS through sidebar in Apex skin

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Product-apex Mediawiki - Apex skin mediawiki-apex_skin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47847

CVSS Score-6.9||MEDIUM

EPSS-0.78% / 73.30%

||

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:47

Updated-16 Oct, 2024 | 16:42

Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Product-cargo Mediawiki - Cargo mediawiki-cargo

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47846

CVSS Score-6.9||MEDIUM

EPSS-0.40% / 59.81%

||

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:39

Updated-16 Oct, 2024 | 16:42

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Product-cargo Mediawiki - Cargo mediawiki-cargo

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2024-47849

CVSS Score-8.8||HIGH

EPSS-0.38% / 58.87%

||

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:29

Updated-16 Oct, 2024 | 16:34

Backticks can allow the usage of not-allowed SQL functions

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.