Vendor CVEs

Wikimedia Foundation

All CVEs

301 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-39933	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Apr 7, 2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release…
CVE-2026-39838	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Apr 7, 2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release…
CVE-2026-22711	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Apr 7, 2026	Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and…
CVE-2025-62661	Wikimedia Foundation Mediawiki Extensions Growthexperiments	Med	0.45	—	0.00	Oct 21, 2025	Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth…
CVE-2025-62702	Wikimedia Foundation Mediawiki Extensions Pagetriage	Med	0.45	—	0.00	Oct 21, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.
CVE-2025-62701	Wikimedia Foundation Mediawiki - Wikistories	Med	0.45	—	0.00	Oct 21, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.
CVE-2025-62694	Wikimedia Foundation Mediawiki Extensions Wikilove	Med	0.45	—	0.00	Oct 21, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.
CVE-2025-62699	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Oct 21, 2025	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong…
CVE-2025-62696	Wikimedia Foundation Mediawiki Foundation - Springboard Extension	Med	0.45	—	0.01	Oct 21, 2025	Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.
CVE-2025-62695	Wikimedia Foundation Mediawiki Extensions Wikilambda	Med	0.45	—	0.00	Oct 21, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.
CVE-2025-62700	Wikimedia Foundation Mediawiki Extensions Multiboilerplate	Med	0.45	—	0.00	Oct 20, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before…
CVE-2025-62698	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Oct 20, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.
CVE-2025-62693	Wikimedia Foundation Mediawiki Extensions Lastmodified	Med	0.45	—	0.00	Oct 20, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39.
CVE-2025-11937	Wikimedia Foundation SecurePoll Extension	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.
CVE-2025-62670	Wikimedia Foundation Mediawiki	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.
CVE-2025-62669	Wikimedia Foundation Mediawiki Extensions Centralauth	Med	0.45	—	0.00	Oct 18, 2025	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.
CVE-2025-62668	Wikimedia Foundation Mediawiki Extensions Growthexperiments	Med	0.45	—	0.00	Oct 18, 2025	Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
CVE-2025-62667	Wikimedia Foundation Mediawiki Extensions Growthexperiments	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
CVE-2025-62666	Wikimedia Foundation Mediawiki Extensions Cirrussearch	Med	0.45	—	0.00	Oct 18, 2025	Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.
CVE-2025-62664	Wikimedia Foundation Mediawiki Extensions Imagerating	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.
CVE-2025-62663	Wikimedia Foundation Mediawiki Extensions Uploadwizard	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.
CVE-2025-62662	Wikimedia Foundation Mediawiki Extensions Advancedsearch	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.
CVE-2025-62665	Wikimedia Foundation Mediawiki - Skin:BlueSky	Med	0.45	—	0.00	Oct 18, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.
CVE-2025-32080	Wikimedia Foundation Mediawiki - Mobile Frontend Extension	Med	0.45	—	0.00	Apr 11, 2025	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.
CVE-2025-32078	Wikimedia Foundation Mediawiki - Version Compare Extension	Med	0.45	—	0.00	Apr 11, 2025	Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.
CVE-2025-32077	Wikimedia Foundation Mediawiki - Extension:SimpleCalendar	Med	0.45	—	0.00	Apr 11, 2025	Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.
CVE-2025-32076	Wikimedia Foundation Mediawiki Extensions Visualdata	Med	0.45	—	0.00	Apr 11, 2025	Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.
CVE-2025-32075	Wikimedia Foundation Mediawiki - Tabs Extension	Med	0.45	—	0.00	Apr 11, 2025	Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.
CVE-2025-32072	Wikimedia Foundation Mediawiki Core - Feed Utils	Med	0.45	—	0.00	Apr 11, 2025	Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.
CVE-2024-47848	Wikimedia Foundation Mediawiki - PageTriage	Med	0.45	—	0.01	Oct 5, 2024	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVE-2026-13707	Wikimedia Foundation OAuth	Hig	0.42	7.6	0.00	Jul 1, 2026	Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-34092	MediaWiki Mediawiki	Hig	0.42	7.5	0.00	May 11, 2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34088	MediaWiki Mediawiki	Hig	0.42	7.5	0.00	May 11, 2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2025-67480	MediaWiki Mediawiki	Med	0.42	6.5	0.00	Feb 3, 2026	Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
CVE-2025-52738	Wikimedia Foundation Wikipedia Preview	Med	0.42	6.5	0.00	Oct 22, 2025	Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
CVE-2025-53502	Wikimedia Foundation Mediawiki Extensions Featuredfeeds	Med	0.42	6.5	0.00	Jul 3, 2025	Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
CVE-2025-53494	Wikimedia Foundation Mediawiki - TwoColConflict Extension	Med	0.42	6.5	0.00	Jul 2, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from…
CVE-2025-53493	Wikimedia Foundation Mediawiki - MintyDocs Extension	Med	0.42	6.5	0.00	Jul 2, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
CVE-2025-32079	Wikimedia Foundation Mediawiki - GrowthExperiments	Med	0.42	6.5	0.00	Apr 11, 2025	Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.
CVE-2025-23078	Wikimedia Foundation Mediawiki Extensions Breadcrumbs2	Med	0.42	6.5	0.00	Jan 10, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before…
CVE-2023-45359	MediaWiki Vector Skin	Med	0.42	6.5	0.00	Oct 9, 2024	An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup.
CVE-2021-46148	MediaWiki Mediawiki	Med	0.42	6.5	0.01	Jan 10, 2022	An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
CVE-2021-44857	MediaWiki Mediawiki	Med	0.42	6.5	0.01	Dec 17, 2021	An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any…
CVE-2012-4379	MediaWiki Mediawiki	Med	0.42	6.5	0.01	Oct 19, 2017	MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.
CVE-2025-7056	Wikimedia Foundation Mediawiki Extensions Urlshortener	Med	0.41	6.3	0.00	Jul 7, 2025	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Extension allows Stored XSS.This issue affects Mediawiki - UrlShortener Extension: from 1.42.X before 1.42.7, from 1.43.X…
CVE-2026-14363	MediaWiki Cargo	Cri	0.40	9.8	0.00	Jul 1, 2026	Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
CVE-2026-34095	MediaWiki Mediawiki	Med	0.40	6.1	0.00	May 11, 2026	Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-39841	MediaWiki Cargo	Med	0.40	6.1	0.00	Apr 7, 2026	Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39840	MediaWiki Cargo	Med	0.40	6.1	0.00	Apr 7, 2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39839	MediaWiki Cargo	Med	0.40	6.1	0.00	Apr 7, 2026	Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVE-2026-39933MedApr 7, 2026
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release…
CVE-2026-39838MedApr 7, 2026
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release…
CVE-2026-22711MedApr 7, 2026
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and…
CVE-2025-62661MedOct 21, 2025
Wikimedia Foundation
Mediawiki Extensions Growthexperiments
risk 0.45cvss —epss 0.00
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth…
CVE-2025-62702MedOct 21, 2025
Wikimedia Foundation
Mediawiki Extensions Pagetriage
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.
CVE-2025-62701MedOct 21, 2025
Wikimedia Foundation
Mediawiki - Wikistories
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.
CVE-2025-62694MedOct 21, 2025
Wikimedia Foundation
Mediawiki Extensions Wikilove
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.
CVE-2025-62699MedOct 21, 2025
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong…
CVE-2025-62696MedOct 21, 2025
Wikimedia Foundation
Mediawiki Foundation - Springboard Extension
risk 0.45cvss —epss 0.01
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.
CVE-2025-62695MedOct 21, 2025
Wikimedia Foundation
Mediawiki Extensions Wikilambda
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.
CVE-2025-62700MedOct 20, 2025
Wikimedia Foundation
Mediawiki Extensions Multiboilerplate
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before…
CVE-2025-62698MedOct 20, 2025
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.
CVE-2025-62693MedOct 20, 2025
Wikimedia Foundation
Mediawiki Extensions Lastmodified
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39.
CVE-2025-11937MedOct 18, 2025
Wikimedia Foundation
SecurePoll Extension
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.
CVE-2025-62670MedOct 18, 2025
Wikimedia Foundation
Mediawiki
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.
CVE-2025-62669MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Centralauth
risk 0.45cvss —epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.
CVE-2025-62668MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Growthexperiments
risk 0.45cvss —epss 0.00
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
CVE-2025-62667MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Growthexperiments
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
CVE-2025-62666MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Cirrussearch
risk 0.45cvss —epss 0.00
Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.
CVE-2025-62664MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Imagerating
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.
CVE-2025-62663MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Uploadwizard
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.
CVE-2025-62662MedOct 18, 2025
Wikimedia Foundation
Mediawiki Extensions Advancedsearch
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.
CVE-2025-62665MedOct 18, 2025
Wikimedia Foundation
Mediawiki - Skin:BlueSky
risk 0.45cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.
CVE-2025-32080MedApr 11, 2025
Wikimedia Foundation
Mediawiki - Mobile Frontend Extension
risk 0.45cvss —epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.
CVE-2025-32078MedApr 11, 2025
Wikimedia Foundation
Mediawiki - Version Compare Extension
risk 0.45cvss —epss 0.00
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.
CVE-2025-32077MedApr 11, 2025
Wikimedia Foundation
Mediawiki - Extension:SimpleCalendar
risk 0.45cvss —epss 0.00
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.
CVE-2025-32076MedApr 11, 2025
Wikimedia Foundation
Mediawiki Extensions Visualdata
risk 0.45cvss —epss 0.00
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.
CVE-2025-32075MedApr 11, 2025
Wikimedia Foundation
Mediawiki - Tabs Extension
risk 0.45cvss —epss 0.00
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.
CVE-2025-32072MedApr 11, 2025
Wikimedia Foundation
Mediawiki Core - Feed Utils
risk 0.45cvss —epss 0.00
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.
CVE-2024-47848MedOct 5, 2024
Wikimedia Foundation
Mediawiki - PageTriage
risk 0.45cvss —epss 0.01
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVE-2026-13707HigJul 1, 2026
Wikimedia Foundation
OAuth
risk 0.42cvss 7.6epss 0.00
Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-34092HigMay 11, 2026
MediaWiki
Mediawiki
risk 0.42cvss 7.5epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34088HigMay 11, 2026
MediaWiki
Mediawiki
risk 0.42cvss 7.5epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2025-67480MedFeb 3, 2026
MediaWiki
Mediawiki
risk 0.42cvss 6.5epss 0.00
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
CVE-2025-52738MedOct 22, 2025
Wikimedia Foundation
Wikipedia Preview
risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
CVE-2025-53502MedJul 3, 2025
Wikimedia Foundation
Mediawiki Extensions Featuredfeeds
risk 0.42cvss 6.5epss 0.00
Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
CVE-2025-53494MedJul 2, 2025
Wikimedia Foundation
Mediawiki - TwoColConflict Extension
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from…
CVE-2025-53493MedJul 2, 2025
Wikimedia Foundation
Mediawiki - MintyDocs Extension
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
CVE-2025-32079MedApr 11, 2025
Wikimedia Foundation
Mediawiki - GrowthExperiments
risk 0.42cvss 6.5epss 0.00
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.
CVE-2025-23078MedJan 10, 2025
Wikimedia Foundation
Mediawiki Extensions Breadcrumbs2
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before…
CVE-2023-45359MedOct 9, 2024
MediaWiki
Vector Skin
risk 0.42cvss 6.5epss 0.00
An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup.
CVE-2021-46148MedJan 10, 2022
MediaWiki
Mediawiki
risk 0.42cvss 6.5epss 0.01
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
CVE-2021-44857MedDec 17, 2021
MediaWiki
Mediawiki
risk 0.42cvss 6.5epss 0.01
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any…
CVE-2012-4379MedOct 19, 2017
MediaWiki
Mediawiki
risk 0.42cvss 6.5epss 0.01
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.
CVE-2025-7056MedJul 7, 2025
Wikimedia Foundation
Mediawiki Extensions Urlshortener
risk 0.41cvss 6.3epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Extension allows Stored XSS.This issue affects Mediawiki - UrlShortener Extension: from 1.42.X before 1.42.7, from 1.43.X…
CVE-2026-14363CriJul 1, 2026
MediaWiki
Cargo
risk 0.40cvss 9.8epss 0.00
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
CVE-2026-34095MedMay 11, 2026
MediaWiki
Mediawiki
risk 0.40cvss 6.1epss 0.00
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-39841MedApr 7, 2026
MediaWiki
Cargo
risk 0.40cvss 6.1epss 0.00
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39840MedApr 7, 2026
MediaWiki
Cargo
risk 0.40cvss 6.1epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39839MedApr 7, 2026
MediaWiki
Cargo
risk 0.40cvss 6.1epss 0.00
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Page 2 of 7