Critical severity9.8NVD Advisory· Published Jul 4, 2025· Updated Apr 15, 2026
CVE-2025-53484
CVE-2025-53484
Description
User-controlled inputs are improperly escaped in:
* VotePage.php (poll option input)
* ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names)
This allows attackers to inject JavaScript and compromise user sessions under certain conditions.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.