CVE-2025-53480
Description
The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders affected message keys.
This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Reflected XSS in MediaWiki CheckUser's Special:Investigate via unescaped internationalized messages triggered by ?uselang=x-xss.
The CheckUser extension's Special:Investigate page, specifically the Account information tab, is vulnerable to reflected cross-site scripting (XSS) due to improper escaping of certain internationalization (i18n) messages. The vulnerability affects the messages checkuser-investigate-preliminary-table-cell-wiki-nowiki and rev-deleted-user, which are rendered without proper sanitization [1].
An attacker can trigger the XSS by appending ?uselang=x-xss to the URL of the Special:Investigate page. This parameter forces the interface to use a special language code designed to test for unescaped output, causing the vulnerable message keys to execute script content if they contain malicious payloads [1]. No authentication is required for this attack vector, as the page is accessible to anyone who can visit the special page.
Successfully exploiting this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to actions such as session hijacking, defacement, or theft of sensitive information displayed on the page. The attack is reflected and requires the victim to click a crafted link, making it a typical reflected XSS scenario.
The vulnerability is fixed in CheckUser versions 1.39.13, 1.42.7, and 1.43.2, released as part of the Mediawiki security update. Users should upgrade to these or later versions immediately [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: >=1.39.0,<1.39.13, >=1.42.0,<1.42.7, >=1.43.0,<1.43.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.