CVE-2025-32077

The SimpleCalendar extension for MediaWiki fails to properly sanitize user-supplied values in the dayformat and title parameters of the #calendar parser function. This improper input validation allows an attacker to inject arbitrary HTML and JavaScript, leading to cross-site scripting (XSS) vulnerabilities [1].

An attacker can exploit the dayformat parameter by saving a page with {{#calendar: month=01 | dayformat=\m\e\o\w}} and then editing the system messages "january" or "meow" to include malicious script, or by using uselang=x-xss to trigger the payload. Alternatively, the title parameter can be directly abused with a value like > to execute JavaScript when the page is viewed [1].

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to account takeover, theft of sensitive data, or defacement of the wiki. The vulnerability affects SimpleCalendar versions from 1.39 through 1.43 [1].

Patches have been committed to the extension's repository for branches REL1_39, REL1_42, REL1_43, and master. Users are strongly advised to update to the latest patched version to mitigate the risk [1].