Medium severity5.4NVD Advisory· Published Jul 7, 2025· Updated Jun 17, 2026
CVE-2025-53487
CVE-2025-53487
Description
The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped.
This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: >=1.39.0,<1.39.13, >=1.42.0,<1.42.7, >=1.43.0,<1.43.2
- Range: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.