CVE-2025-7363

Vulnerability

The TitleIcon extension for MediaWiki is vulnerable to stored cross-site scripting (XSS) through the #titleicon_unicode parser function. User-supplied input is directly wrapped in an HtmlArmor object without any sanitization or validation, then rendered in the page header. This means any wikitext using this function can inject arbitrary HTML and JavaScript.

Exploitation

An attacker can exploit this by inserting a malicious payload, such as ``, into a wiki page via the parser function. The payload executes when a victim visits the page. The vulnerability also likely affects search results, as noted in the Phabricator report [1]. No special privileges are required beyond the ability to edit pages, making it accessible to any user with edit rights.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session theft, credential exfiltration, defacement, or further actions within the wiki environment.

Mitigation

The issue is fixed in TitleIcon versions 6.2.1 (for older branches) and 6.3.0 (for newer branches), corresponding to MediaWiki 1.39.13, 1.42.7, and 1.43.2. Users should update their extension to the patched version. No workaround is available without updating.