Mediawiki
Monthly
Privilege escalation in BlueSpice container deployments (bluespice/wiki image, versions 5.2.3 through 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC) lets an attacker who can read the wiki obtain an application token from the REST API and exchange it for a session carrying sysop privileges as the internal service user. Because the token authenticator's IP allow-list is disabled by default when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset, no authentication is required on publicly readable wikis (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), while on access-controlled wikis a low-privileged read account suffices. Vendor-released fixes are available (5.2.7 and later, or a 5.2.7 image published on/after 2026-10-19 15:37 UTC); no public exploit code or confirmed active exploitation was identified at time of analysis. Severity is 9.3 (CVSS 4.0), and the priority decision is act_now.
Authorization bypass in the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 lets an authenticated wiki user reference and operate on objects belonging to another user or scope, because the extension resolves a client-supplied object key without re-authorizing it against the requesting account. Exploitation is gated: the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a valid account, high attack complexity, an attack precondition that must be present, and some victim-side interaction, and only wikis that explicitly install WikiLambda rather than plain MediaWiki are exposed. No confirmed active exploitation is reported (not listed in CISA KEV); the advisory's CVSS 4.0 vector carries an E:P exploit-maturity metric and a Gerrit change is linked, indicating an upstream fix and proof-of-concept-level maturity rather than confirmed in-the-wild attacks, with no EPSS data supplied.
Code injection in the MediaWiki CentralAuth extension (versions 1.43, 1.45 and 1.46) lets an already highly privileged operator who controls a CentralAuth configuration or system setting push attacker-influenced values into executable code paths, with the impact crossing into other federated wikis because the vulnerable component changes scope. Exploitation is not reachable by anonymous users: the assessed vector requires high privileges (PR:H), high attack complexity (AC:H), a present attack requirement (AT:P) and a passive user-interaction step (UI:P), so a victim session or request must traverse the vulnerable code path. There is no CISA KEV listing confirming active exploitation, and the vendor's CVSS 4.0 vector carries only an E:P (proof-of-concept) exploit-maturity metric; the overall picture is a real but conditions-gated, lower-urgency issue affecting multi-wiki/wiki-farm SSO deployments rather than standalone MediaWiki installs.
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.
Missing authorization checks in the MediaWiki TemplateSandbox extension let unauthenticated remote users reach functionality that should be constrained by access-control lists, yielding a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact. Exposure is limited to wikis that have the optional TemplateSandbox extension installed and enabled; a default MediaWiki core installation is not affected, and the fixed releases are 1.46.1, 1.45.5, and 1.43.10 for their respective branches. No public exploit code has been identified at time of analysis (EPSS 0.15%, 3rd percentile) and CISA SSVC records exploitation as none, although the issue is rated automatable with total technical impact, so the risk is serious but not yet observed as active.
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in Semantic MediaWiki 3.1.0 through 6.x lets users with the MediaWiki 'edit' right inject arbitrary HTML and JavaScript via the data-subtab attribute, with execution occurring when a victim views the affected page. Publicly available exploit code exists, but the independent assessment rates this as a moderate-severity issue because it requires edit privileges and user interaction. The flaw is fixed in Semantic MediaWiki 7.0.0.
The MediaWiki CSS extension in versions 1.39, 1.43, and 1.44 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server. Public exploit code exists for this vulnerability, enabling attackers to access sensitive information outside the intended directory restrictions. A patch is available and should be applied immediately to affected installations.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 48.0%.
Cross-site scripting in the MediaWiki CommonsMetadata extension (versions 1.43, 1.45 and 1.46) allows an authenticated editor who can write attacker-controlled content into file/media metadata to plant script-related HTML that executes when another user views the rendered page, giving low confidentiality and integrity impact confined to the victim's browser session. The root cause is CWE-80 (improper neutralization of script-related HTML tags), and the vendor's CVSS v4 score of 1.1 reflects high privileges (PR:H), an attack requirement (AT:P) and passive user interaction (UI:P), with a proof-of-concept-level exploit maturity metric (E:P) rather than any observed attacks. The independent assessment agrees this is a low-priority, low-real-risk issue that requires the optional extension to be installed and a victim to subsequently view the injected page; no CISA KEV listing or other confirmation of active exploitation appears in the available data, and Wikimedia has published both a tracking task and an associated Gerrit change addressing the flaw.
Cross-site scripting in the MediaWiki Wikbase (Wikibase) extension lets a privileged, authenticated contributor inject script-related HTML into wiki content that is subsequently rendered to other users visiting the affected page. The flaw affects installations running the extension on MediaWiki 1.46, 1.45, and 1.43, and requires both an attacker account with elevated rights and a victim who views the crafted page; independent assessment confirms a low-risk, basic XSS (CWE-80) with Low confidentiality, integrity, and availability impact, matching the very low vendor CVSS 4.0 score of 0.3. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.
Reflected cross-site scripting in the MediaWiki ReadingLists extension (versions 1.45 and 1.46) lets an authenticated user with access to the extension inject script-related HTML into a page through a crafted URL parameter that is echoed back unsanitized. Because the flaw is reflected rather than stored, an attacker must lure a separate logged-in victim into following the malicious link, and any script executes only within that victim's browser session - there is no server-side compromise. This is a low-priority issue despite being network-reachable: no public exploit code has been identified at time of analysis, exploitation is blocked on wikis that do not have the extension or have applied the upstream fix, and the attack is further constrained by the requirement that the victim actively follow the crafted URL.
Stored cross-site scripting in the MediaWiki Page Forms extension (versions 1.43, 1.45, and 1.46) lets an authenticated user who can submit or edit Page Forms content plant script-related HTML that executes in the browser of any other user who later views the affected page. Exploitation is high-friction: the attacker must hold a valid MediaWiki account with form-edit privileges, stored payloads only fire when a second user opens the poisoned page, and the late-breaking CVSS 4.0 score is only 1.2 while our independent assessment rates confidentiality and integrity impact Low with no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); realistic harm depends on luring a higher-privileged user to view the tainted page.
Stored cross-site scripting (XSS) in the MediaWiki WikiForum extension allows an authenticated attacker holding a privileged forum role to plant script-related HTML that executes in the browser of any user who later views the manipulated forum page. The flaw is rooted in improper neutralization of script-related HTML tags (CWE-80) within WikiForum-managed fields on the master branch, and successful exploitation demands both elevated WikiForum permissions and victim interaction, which is why the vendor assigns it a very low CVSS 4.0 score of 1.1 and the independent assessment treats it as a low-priority issue. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (not in CISA KEV), so the practical risk is primarily limited to wiki instances that run this optional extension.
Cross-site scripting (XSS) in the MediaWiki Collection (Book) extension affects versions 1.43, 1.45, and 1.46 and allows an authenticated low-privilege editor to inject script-related HTML into collection/book fields, which then executes when a separate victim interacts with the rendered page. The flaw targets non-script HTML elements (CWE-80), and exploitation is constrained by the requirement that the extension be installed and enabled, by the attacker needing editing access, and by mandatory victim interaction; the vendor assigns CVSS v4 base score 1.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/E:P). The supplied CVSS v4 vector's E:P metric indicates that publicly available exploit code exists, but there is no CISA KEV listing, and our independent CVSS v3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees this is low priority.
Stored cross-site scripting in the MediaWiki CentralAuth extension allows an attacker who can persist a crafted payload into a CentralAuth-handled field to have that script execute in the browser session of any user who later views the affected page. Affected are CentralAuth installations on branches before 1.46.1, before 1.45.5, and before 1.43.10; plain MediaWiki deployments that do not run the CentralAuth extension are not affected. The vendor has already published fixed versions, and no public exploit code or active exploitation has been identified at time of analysis, so this rates as a moderate-priority (CVSS 6.1) issue rather than an emergency.
Stored cross-site scripting in the Wikimedia CentralNotice extension lets anyone who can create or edit a banner/campaign persist a JavaScript payload that executes in the browser of every user who views the rendered notice, allowing session-rideable actions and content tampering within the victim's MediaWiki origin. MediaWiki installations running an affected non-default CentralNotice build (before 1.46.1, 1.45.5, or 1.43.10) are exposed; per the CISA SSVC evaluation exploitation has not been observed, automatable exploitation is assessed as no, and no public exploit code was identified at time of analysis, though the vendor's CVSS vector (6.1, PR:N) understates the privilege realistically required to store the payload. Our independent assessment keeps the vendor's CVSS:3.1:AV:N/AC:L/S:C/C:L/I:L/UI:R base but changes the privilege requirement to PR:L, since injecting via a CentralNotice banner field normally demands the centralnotice-admin user right, and impact remains partial confidentiality/integrity with no availability effect.
Stored cross-site scripting in the MediaWiki MassMessage extension allows an authenticated user who can submit message content processed by the extension to inject script that executes in the browser session of any user who later views the generated page. Affected deployments are those running the optional MassMessage extension on a branch older than 1.46.1, 1.45.5, or 1.43.10; core MediaWiki without the extension is not impacted. Rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires user interaction (the victim viewing the page) and yields limited confidentiality and integrity impact confined to the victim's browser; no public exploit code has been identified at time of analysis and CISA SSVC records Exploitation=none with Automatable=no.
Stored cross-site scripting in the Wikimedia MediaWiki WikiLambda extension (the software behind Wikifunctions / Abstract Wikipedia) allows an attacker who can store content processed by the extension - such as a ZObject function definition - to have an unneutralized script payload executed in the browser of any user who later views the rendered page. Only installations running the WikiLambda extension at a version before 1.46.1 are affected, which is a narrowly deployed component, and impact is bounded to low confidentiality and integrity with no availability effect (CVSS 6.1, assessed vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA SSVC rates exploitation as none and automatable as no, so this is a genuine but low-urgency issue rather than an emergency; the highest-value outcome for an attacker is planting a payload that is later rendered to a privileged administrator.
Cross-site scripting in the WikiLambda extension for MediaWiki allows a high-privileged wiki contributor to store script-bearing markup that executes in the browser of another user who views the crafted content, giving limited client-side impact (CVSS 3.1 base vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; vendor-published CVSS 4.0 score 4.8). Only the pre-release version 1.47.0-alpha of the extension is affected, and the flaw has been remediated on the master branch, so no stable numbered MediaWiki release carries the vulnerable code; realistic exposure is confined to development or alpha deployments that have installed the extension. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuinely low-priority XSS despite the CWE-79 label.
Cross-site scripting in the Wikimedia MediaWiki UploadWizard extension allows attackers to inject script that executes in the browser session of a user interacting with crafted upload-flow content. The flaw is present in all versions of the extension prior to 1.46.1, 1.45.5, and 1.43.10, and the CVSS 4.0 vector confirms no privileges are required to introduce the payload (PR:N) while successful execution depends on victim interaction (UI:P), so exploitation yields low confidentiality and integrity impact scoped to the affected component. A vendor-released patch is available via the linked Wikimedia Gerrit change and Phabricator task, and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) makes this a genuine but low-priority issue.
Reflected cross-site scripting in the MediaWiki Cargo extension (versions through 3.9.4) lets remote, unauthenticated attackers execute arbitrary script in the origin of an affected wiki by convincing a victim to open a crafted URL while logged in. The defect is a CWE-79 improper-neutralization issue that the vendor rates 6.9 (Medium) under CVSS 4.0, whereas the independent assessment applies CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, explicitly requiring victim user interaction that the vendor vector omits; impact is confined to the victim's browser session within the wiki's origin rather than the server host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exposure is limited to the subset of wikis where this optional extension is installed and enabled.
Reflected cross-site scripting in the MediaWiki Cargo extension, affecting all versions through 3.9.4, allows an unauthenticated attacker to inject script that executes in the browser of any wiki user who follows a crafted link. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation requires victim interaction - the target must open the malicious URL - and impact is limited to the victim's session on the affected wiki, with the scope change reflecting that the injected content can affect resources beyond the vulnerable component. No public exploit code has been identified and there is no CISA KEV entry: no public exploit identified at time of analysis. Exposure is confined to wikis that have installed and enabled Cargo, a non-core, separately deployed extension, and the Cargo query/reporting functionality must be reachable.
Stored cross-site scripting (XSS) in the MediaWiki Cargo extension through version 3.9.4 allows attackers to inject persistent malicious scripts into wiki pages that execute in the browsers of users viewing the content. The flaw requires the ability to save content that populates Cargo-stored data (typically an authenticated editor, though open wikis with anonymous editing may also be vulnerable) and user interaction from a victim. The Wikimedia Foundation reported the issue, but no public exploit code has been identified, and no vendor patch is yet available.
Information disclosure in the MediaWiki WikiLambda extension - the software behind Wikifunctions - before version 1.47.0 lets remote, unauthenticated attackers reach functionality that should be constrained by access-control lists, exposing limited, low-sensitivity data. Exploitation requires a reachable wiki with WikiLambda installed and carries high attack complexity (CVSS v4.0 2.9; assessed CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N), meaning it likely hinges on a specific request pattern, function state, or race that defeats the intended ACL check rather than working against arbitrary default requests. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; combined with confidentiality-only impact and the specialized, not-widely-deployed nature of the extension, this is a low-priority issue by every available signal.
Reflected cross-site scripting in Semantic MediaWiki 7.0.0 through 7.1.0 lets an unauthenticated attacker execute arbitrary script in a victim's browser on the wiki origin by tricking them into opening a crafted Special:Ask link carrying a forged cursor pagination token. The cursor parameter added in 7.0.0 is an unsigned base64url-encoded JSON blob, so its sort_prop and sort_order fields are fully attacker-controlled; when they mismatch the request's sort=/order= values, the resulting error string is interpolated into Query::addErrors() and rendered as raw HTML by Html::errorBox(), bypassing the message-layer sanitization that normally protects SMW error output. Exploitation requires victim interaction (clicking the link) and is aided by the absence of a Content-Security-Policy on responses, which permits inline script to run; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the maintainer advisory documents a browser-confirmed reproduction, and the CVSS 3.1 score is 6.1 with a scope change. Upgrading to 7.2.0 removes the vulnerability.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier lets an unauthenticated remote attacker inject arbitrary markup into the query debug output rendered on Special:Ask, executing JavaScript in the browser of a victim who follows a crafted link. No account, privilege, or attacker-created wiki content is required: the predefined text-type properties such as Text (_txt) that ship on every default install satisfy the property-type condition the payload needs, so a URL like Special:Ask?q=[[Text::<script>...</script>]]&debug=1 is sufficient. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 base score, reflecting a scope-changing, low-impact script injection that depends on user interaction and is therefore not self-propagating or wormable; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing). Vendor-released patch: 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows unauthenticated attackers to inject arbitrary HTML markup into the Special:Ask table output by abusing the `sep` (separator) parameter, which was inserted verbatim into the HTML that joins a table cell's values. Because the same unsanitized table HTML is produced for the raw request output (request_type=raw), no authentication is needed to reach the injection, though exploitation is limited by user interaction: a victim must be induced to load a crafted query URL for the payload to execute in their browser. The issue is correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) as a moderate-severity reflected XSS; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows an attacker to inject script into the Special:SearchByProperty page through the `property` and `value` query parameters, executing arbitrary JavaScript in the browser of any wiki user lured to a crafted URL. Rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw needs no authentication to construct or deliver the malicious link but does require victim interaction (UI:R), and impact is confined to the victim's browser session with no server-side code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor released a fix in SMW 7.2.0 that escapes both the reflected form value and the derived error messages.
Reflected cross-site scripting (CWE-79) in Semantic MediaWiki 7.1.0 and earlier allows a crafted URL to execute script in a victim's browser session; the flaw is reached through the Special:Ask result printer when it is invoked with headers=plain and an attacker-controlled mainlabel value, which is written into the table header (<th>) through a raw HTML path instead of being escaped for the output context. The vulnerability is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to craft the link, but exploitation depends on the victim opening the malicious URL (user interaction is required) and impact scales with the victim's wiki privileges. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Semantic MediaWiki 7.2.0, so deployments on 7.1.0 or earlier that expose Special:Ask queries are the realistic exposure.
Deserialization of untrusted data in MediaWiki's wiki import subsystem and logging infrastructure exposes installations to PHP object injection, with high integrity impact on affected systems. Specifically, the WikiImporter, WikiRevision, and LogEntryBase components process attacker-controlled serialized data without sufficient validation, allowing a high-privileged authenticated user to trigger unintended object instantiation or code execution paths. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; however, vendor-confirmed patches are available in releases 1.43.9, 1.44.6, 1.45.4, and 1.46.0.
Authentication API endpoints and Special pages in MediaWiki expose low-severity confidentiality and integrity weaknesses exploitable by unauthenticated remote attackers who can induce victim user interaction. Five files spanning account-linking and credential management operations - ApiChangeAuthenticationData, ApiLinkAccount, ApiRemoveAuthenticationData, SpecialLinkAccounts, and SpecialUnlinkAccounts - are affected across all MediaWiki releases prior to the fixed branches 1.43.9, 1.44.6, 1.45.4, and the forthcoming 1.46.0. No public exploit code and no active exploitation have been identified at time of analysis; real-world risk is constrained by the user-interaction prerequisite and the limited impact scope.
Cross-site scripting in Wikimedia Foundation MediaWiki and the CentralAuth extension allows authenticated low-privileged users to inject malicious scripts into rendered wiki pages or API output through unsanitized input in API formatting, ResourceLoader module handling, page display hooks, and permission change log formatting. Affected versions span all releases of both products prior to the 1.46.0, 1.45.4, 1.44.6, and 1.43.9 patch series. No public exploit code or CISA KEV listing has been identified at time of analysis, though the five affected PHP files suggest a broad attack surface across core MediaWiki subsystems.
Information disclosure in MediaWiki's core parser component (includes/Parser/Parser.php) allows authenticated low-privilege users, under conditions requiring user interaction, to obtain sensitive information not intended for their access level. All MediaWiki branches are affected up to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0, covering a broad installation base including self-hosted wikis worldwide. No public exploit code exists and no active exploitation has been confirmed at time of analysis; however, the provided CVSS 4.0 vector contains a contradictory zero-impact scoring that warrants independent verification against the upstream advisory.
Cross-site scripting in MediaWiki's JavaScript API client layer (resources/src/mediawiki.Api/index.js) allows network-accessible, unauthenticated attackers to inject malicious scripts that execute in a victim's browser upon user interaction. All MediaWiki deployments prior to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected, covering a broad range of wiki installations worldwide. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of authentication requirement elevate concern for public-facing deployments.
Sensitive information exposure in MediaWiki's InfoAction.php allows unauthenticated remote actors to obtain restricted page metadata through the 'Info' action endpoint. All MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected across all deployment configurations. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and lack of authentication requirements make opportunistic discovery straightforward for any actor who can reach the wiki.
Cross-site scripting vulnerabilities across multiple log formatter and language components in MediaWiki allow authenticated low-privilege users to inject malicious JavaScript that executes in the browser of any user who views affected log pages or the SpecialVersion special page. The vulnerability spans seven PHP files covering block, patrol, rename-user, and tag log formatters, the base LogFormatter, the Language class, and SpecialVersion - indicating widespread unsanitized output rendering in administrative and logging interfaces. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the breadth of affected components and the multiple concurrent fix branches (1.43.9, 1.44.6, 1.45.4, 1.46.0) signal a significant audit-driven remediation effort.
Insufficient permission enforcement in MediaWiki's user query API endpoints allows low-privileged authenticated users to access sensitive user information - such as group memberships or account details - that permission controls should restrict. The vulnerability spans four source files: ApiQueryAllUsers.php, ApiQueryUsers.php, PermissionManager.php, and UserGroupManager.php, indicating that the flaw lies in how permission checks are applied (or bypassed) when the API serializes user data. No public exploit code exists and the CVSS 4.0 score of 2.1 reflects the constrained real-world exploitability. No confirmed active exploitation (CISA KEV) has been reported.
Information disclosure in MediaWiki's ApiUserrights.php exposes sensitive user rights data to authenticated actors who should not have access to it. All MediaWiki installations running versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected. The CVSS 4.0 score of 5.1 with low confidentiality impact (VC:L) reflects a bounded but real data leakage risk; no public exploit identified at time of analysis.
Cross-site scripting in MediaWiki's ApiSandbox component (ApiSandboxLayout.js) allows an authenticated attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted ApiSandbox page. Only MediaWiki 1.46.0-rc.0 is confirmed affected; the 1.46.0 stable release resolves the flaw, meaning real-world exposure is limited to deployments running the release candidate. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in MediaWiki's Special:Block Vue.js component allows a high-privileged user - such as a wiki administrator - to inject malicious scripts that execute in the browsers of other users who subsequently view the affected block interface output. The vulnerability is isolated to the `SpecialBlock.Vue` frontend component, gating exploitation behind administrative access. No public exploit has been identified at time of analysis, and no patch version has been confirmed from available data.
MediaWiki's article page rendering code in includes/Page/Article.php exposes limited confidential content to unintended users, constituting an information disclosure under CWE-668 (Exposure of Resource to Wrong Sphere). All MediaWiki deployments running versions prior to 1.43.7, 1.44.4, or 1.45.2 are affected, but exploitation is constrained by high privilege requirements, high attack complexity, and specific preconditions. With a CVSS 4.0 score of 2.0, an EPSS of 0.04% (12th percentile), no CISA KEV listing, and SSVC exploitation status of 'none,' this is a low-priority item suitable for routine patching; no public exploit has been identified at time of analysis.
MediaWiki's SpecialUserRights.php exposes sensitive information to authenticated low-privilege users across versions prior to 1.43.7, 1.44.4, and 1.45.2. The vulnerability resides in the user rights management special page, where insufficient access controls allow a logged-in actor with minimal privileges to read confidential data - likely user group memberships, rights assignments, or related administrative details - that should be restricted to privileged operators. No public exploit exists and SSVC rates exploitation as none, placing this firmly in low-urgency patch territory despite its network-accessible attack vector.
MediaWiki versions before 1.43.7, 1.44.4, and 1.45.2 expose sensitive information to unauthorized actors through improper handling in the Skin.php component. The vulnerability requires authenticated user access and user interaction (CVSS:4.0/AV:N/AC:H/PR:L/UI:P), resulting in low confidentiality impact. With an EPSS score of 2.1 and no evidence of active exploitation, this poses limited real-world risk but should be patched as part of routine maintenance.
Exposure of sensitive information in Wikimedia Foundation MediaWiki allows remote unauthenticated attackers to access unauthorized data via network requests against affected versions before 1.43.7, 1.44.4, and 1.45.2. The vulnerability has low confidentiality impact with CVSS 5.5 and evidence of proof-of-concept code, though no active exploitation in CISA KEV has been confirmed at time of analysis.
MediaWiki before versions 1.43.7, 1.44.4, and 1.45.2 exposes sensitive information to unauthorized actors through a vulnerability requiring user interaction. The flaw allows information disclosure via network access without authentication, though impact is limited (CVSS 1.3) and requires user participation to trigger. Vendor-released patches are available across all affected major versions.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php.
Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php.
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php.
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. [CVSS 6.1 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. [CVSS 4.7 MEDIUM]
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.
Wikimedia Foundation Mediawiki - DiscussionTools Extension is affected by improper neutralization of special elements used in an expression language statement.
Insufficient access controls in the MediaWiki CampaignEvents extension (versions 1.39, 1.43, 1.44, 1.45) permit unauthenticated attackers to perform unauthorized actions by bypassing privilege checks. An attacker could exploit this vulnerability to gain elevated privileges within the extension without proper authorization. A patch is available to remediate this low-impact authorization flaw.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.
Cross-site scripting (XSS) in MediaWiki's GrowthExperiments extension (versions 1.39, 1.43, 1.44, 1.45) allows authenticated attackers to inject malicious scripts through improper input validation, with public exploit code available. An attacker with user privileges can exploit this vulnerability to perform actions on behalf of other users or steal sensitive information due to the low complexity attack vector and user interaction requirement. A patch is available for affected installations.
Improper output encoding in MediaWiki's Approved Revs extension through magic word replacement allows unauthenticated attackers to manipulate input data and conduct content injection attacks. Affected versions 1.39, 1.43, 1.44, and 1.45 are vulnerable to this network-accessible flaw that requires user interaction, and public exploit code exists. A patch is available to remediate the vulnerability.
Cross-site scripting (XSS) in MediaWiki's Wikibase extension allows authenticated attackers to inject malicious scripts through improper input handling during page generation, affecting versions 1.39, 1.43, 1.44, and 1.45. Exploitation requires user interaction and results in limited confidentiality and integrity impact within the affected application context. A patch is available and public exploit code exists for this vulnerability.
Mediawiki-Extensions-Uploadwizard versions up to 1.39 is affected by cross-site scripting (xss) (CVSS 6.1).
Cross-site scripting (XSS) in MediaWiki's ProofreadPage extension (versions 1.39, 1.43, 1.44, 1.45) allows attackers to inject malicious scripts through improper input sanitization during web page generation. Public exploit code exists for this vulnerability, which requires user interaction to trigger. A patch is available to remediate the issue.
Privilege escalation in BlueSpice container deployments (bluespice/wiki image, versions 5.2.3 through 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC) lets an attacker who can read the wiki obtain an application token from the REST API and exchange it for a session carrying sysop privileges as the internal service user. Because the token authenticator's IP allow-list is disabled by default when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset, no authentication is required on publicly readable wikis (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), while on access-controlled wikis a low-privileged read account suffices. Vendor-released fixes are available (5.2.7 and later, or a 5.2.7 image published on/after 2026-10-19 15:37 UTC); no public exploit code or confirmed active exploitation was identified at time of analysis. Severity is 9.3 (CVSS 4.0), and the priority decision is act_now.
Authorization bypass in the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 lets an authenticated wiki user reference and operate on objects belonging to another user or scope, because the extension resolves a client-supplied object key without re-authorizing it against the requesting account. Exploitation is gated: the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a valid account, high attack complexity, an attack precondition that must be present, and some victim-side interaction, and only wikis that explicitly install WikiLambda rather than plain MediaWiki are exposed. No confirmed active exploitation is reported (not listed in CISA KEV); the advisory's CVSS 4.0 vector carries an E:P exploit-maturity metric and a Gerrit change is linked, indicating an upstream fix and proof-of-concept-level maturity rather than confirmed in-the-wild attacks, with no EPSS data supplied.
Code injection in the MediaWiki CentralAuth extension (versions 1.43, 1.45 and 1.46) lets an already highly privileged operator who controls a CentralAuth configuration or system setting push attacker-influenced values into executable code paths, with the impact crossing into other federated wikis because the vulnerable component changes scope. Exploitation is not reachable by anonymous users: the assessed vector requires high privileges (PR:H), high attack complexity (AC:H), a present attack requirement (AT:P) and a passive user-interaction step (UI:P), so a victim session or request must traverse the vulnerable code path. There is no CISA KEV listing confirming active exploitation, and the vendor's CVSS 4.0 vector carries only an E:P (proof-of-concept) exploit-maturity metric; the overall picture is a real but conditions-gated, lower-urgency issue affecting multi-wiki/wiki-farm SSO deployments rather than standalone MediaWiki installs.
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.
Missing authorization checks in the MediaWiki TemplateSandbox extension let unauthenticated remote users reach functionality that should be constrained by access-control lists, yielding a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact. Exposure is limited to wikis that have the optional TemplateSandbox extension installed and enabled; a default MediaWiki core installation is not affected, and the fixed releases are 1.46.1, 1.45.5, and 1.43.10 for their respective branches. No public exploit code has been identified at time of analysis (EPSS 0.15%, 3rd percentile) and CISA SSVC records exploitation as none, although the issue is rated automatable with total technical impact, so the risk is serious but not yet observed as active.
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in Semantic MediaWiki 3.1.0 through 6.x lets users with the MediaWiki 'edit' right inject arbitrary HTML and JavaScript via the data-subtab attribute, with execution occurring when a victim views the affected page. Publicly available exploit code exists, but the independent assessment rates this as a moderate-severity issue because it requires edit privileges and user interaction. The flaw is fixed in Semantic MediaWiki 7.0.0.
The MediaWiki CSS extension in versions 1.39, 1.43, and 1.44 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server. Public exploit code exists for this vulnerability, enabling attackers to access sensitive information outside the intended directory restrictions. A patch is available and should be applied immediately to affected installations.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 48.0%.
Cross-site scripting in the MediaWiki CommonsMetadata extension (versions 1.43, 1.45 and 1.46) allows an authenticated editor who can write attacker-controlled content into file/media metadata to plant script-related HTML that executes when another user views the rendered page, giving low confidentiality and integrity impact confined to the victim's browser session. The root cause is CWE-80 (improper neutralization of script-related HTML tags), and the vendor's CVSS v4 score of 1.1 reflects high privileges (PR:H), an attack requirement (AT:P) and passive user interaction (UI:P), with a proof-of-concept-level exploit maturity metric (E:P) rather than any observed attacks. The independent assessment agrees this is a low-priority, low-real-risk issue that requires the optional extension to be installed and a victim to subsequently view the injected page; no CISA KEV listing or other confirmation of active exploitation appears in the available data, and Wikimedia has published both a tracking task and an associated Gerrit change addressing the flaw.
Cross-site scripting in the MediaWiki Wikbase (Wikibase) extension lets a privileged, authenticated contributor inject script-related HTML into wiki content that is subsequently rendered to other users visiting the affected page. The flaw affects installations running the extension on MediaWiki 1.46, 1.45, and 1.43, and requires both an attacker account with elevated rights and a victim who views the crafted page; independent assessment confirms a low-risk, basic XSS (CWE-80) with Low confidentiality, integrity, and availability impact, matching the very low vendor CVSS 4.0 score of 0.3. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.
Reflected cross-site scripting in the MediaWiki ReadingLists extension (versions 1.45 and 1.46) lets an authenticated user with access to the extension inject script-related HTML into a page through a crafted URL parameter that is echoed back unsanitized. Because the flaw is reflected rather than stored, an attacker must lure a separate logged-in victim into following the malicious link, and any script executes only within that victim's browser session - there is no server-side compromise. This is a low-priority issue despite being network-reachable: no public exploit code has been identified at time of analysis, exploitation is blocked on wikis that do not have the extension or have applied the upstream fix, and the attack is further constrained by the requirement that the victim actively follow the crafted URL.
Stored cross-site scripting in the MediaWiki Page Forms extension (versions 1.43, 1.45, and 1.46) lets an authenticated user who can submit or edit Page Forms content plant script-related HTML that executes in the browser of any other user who later views the affected page. Exploitation is high-friction: the attacker must hold a valid MediaWiki account with form-edit privileges, stored payloads only fire when a second user opens the poisoned page, and the late-breaking CVSS 4.0 score is only 1.2 while our independent assessment rates confidentiality and integrity impact Low with no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); realistic harm depends on luring a higher-privileged user to view the tainted page.
Stored cross-site scripting (XSS) in the MediaWiki WikiForum extension allows an authenticated attacker holding a privileged forum role to plant script-related HTML that executes in the browser of any user who later views the manipulated forum page. The flaw is rooted in improper neutralization of script-related HTML tags (CWE-80) within WikiForum-managed fields on the master branch, and successful exploitation demands both elevated WikiForum permissions and victim interaction, which is why the vendor assigns it a very low CVSS 4.0 score of 1.1 and the independent assessment treats it as a low-priority issue. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (not in CISA KEV), so the practical risk is primarily limited to wiki instances that run this optional extension.
Cross-site scripting (XSS) in the MediaWiki Collection (Book) extension affects versions 1.43, 1.45, and 1.46 and allows an authenticated low-privilege editor to inject script-related HTML into collection/book fields, which then executes when a separate victim interacts with the rendered page. The flaw targets non-script HTML elements (CWE-80), and exploitation is constrained by the requirement that the extension be installed and enabled, by the attacker needing editing access, and by mandatory victim interaction; the vendor assigns CVSS v4 base score 1.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/E:P). The supplied CVSS v4 vector's E:P metric indicates that publicly available exploit code exists, but there is no CISA KEV listing, and our independent CVSS v3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees this is low priority.
Stored cross-site scripting in the MediaWiki CentralAuth extension allows an attacker who can persist a crafted payload into a CentralAuth-handled field to have that script execute in the browser session of any user who later views the affected page. Affected are CentralAuth installations on branches before 1.46.1, before 1.45.5, and before 1.43.10; plain MediaWiki deployments that do not run the CentralAuth extension are not affected. The vendor has already published fixed versions, and no public exploit code or active exploitation has been identified at time of analysis, so this rates as a moderate-priority (CVSS 6.1) issue rather than an emergency.
Stored cross-site scripting in the Wikimedia CentralNotice extension lets anyone who can create or edit a banner/campaign persist a JavaScript payload that executes in the browser of every user who views the rendered notice, allowing session-rideable actions and content tampering within the victim's MediaWiki origin. MediaWiki installations running an affected non-default CentralNotice build (before 1.46.1, 1.45.5, or 1.43.10) are exposed; per the CISA SSVC evaluation exploitation has not been observed, automatable exploitation is assessed as no, and no public exploit code was identified at time of analysis, though the vendor's CVSS vector (6.1, PR:N) understates the privilege realistically required to store the payload. Our independent assessment keeps the vendor's CVSS:3.1:AV:N/AC:L/S:C/C:L/I:L/UI:R base but changes the privilege requirement to PR:L, since injecting via a CentralNotice banner field normally demands the centralnotice-admin user right, and impact remains partial confidentiality/integrity with no availability effect.
Stored cross-site scripting in the MediaWiki MassMessage extension allows an authenticated user who can submit message content processed by the extension to inject script that executes in the browser session of any user who later views the generated page. Affected deployments are those running the optional MassMessage extension on a branch older than 1.46.1, 1.45.5, or 1.43.10; core MediaWiki without the extension is not impacted. Rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires user interaction (the victim viewing the page) and yields limited confidentiality and integrity impact confined to the victim's browser; no public exploit code has been identified at time of analysis and CISA SSVC records Exploitation=none with Automatable=no.
Stored cross-site scripting in the Wikimedia MediaWiki WikiLambda extension (the software behind Wikifunctions / Abstract Wikipedia) allows an attacker who can store content processed by the extension - such as a ZObject function definition - to have an unneutralized script payload executed in the browser of any user who later views the rendered page. Only installations running the WikiLambda extension at a version before 1.46.1 are affected, which is a narrowly deployed component, and impact is bounded to low confidentiality and integrity with no availability effect (CVSS 6.1, assessed vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA SSVC rates exploitation as none and automatable as no, so this is a genuine but low-urgency issue rather than an emergency; the highest-value outcome for an attacker is planting a payload that is later rendered to a privileged administrator.
Cross-site scripting in the WikiLambda extension for MediaWiki allows a high-privileged wiki contributor to store script-bearing markup that executes in the browser of another user who views the crafted content, giving limited client-side impact (CVSS 3.1 base vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; vendor-published CVSS 4.0 score 4.8). Only the pre-release version 1.47.0-alpha of the extension is affected, and the flaw has been remediated on the master branch, so no stable numbered MediaWiki release carries the vulnerable code; realistic exposure is confined to development or alpha deployments that have installed the extension. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuinely low-priority XSS despite the CWE-79 label.
Cross-site scripting in the Wikimedia MediaWiki UploadWizard extension allows attackers to inject script that executes in the browser session of a user interacting with crafted upload-flow content. The flaw is present in all versions of the extension prior to 1.46.1, 1.45.5, and 1.43.10, and the CVSS 4.0 vector confirms no privileges are required to introduce the payload (PR:N) while successful execution depends on victim interaction (UI:P), so exploitation yields low confidentiality and integrity impact scoped to the affected component. A vendor-released patch is available via the linked Wikimedia Gerrit change and Phabricator task, and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) makes this a genuine but low-priority issue.
Reflected cross-site scripting in the MediaWiki Cargo extension (versions through 3.9.4) lets remote, unauthenticated attackers execute arbitrary script in the origin of an affected wiki by convincing a victim to open a crafted URL while logged in. The defect is a CWE-79 improper-neutralization issue that the vendor rates 6.9 (Medium) under CVSS 4.0, whereas the independent assessment applies CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, explicitly requiring victim user interaction that the vendor vector omits; impact is confined to the victim's browser session within the wiki's origin rather than the server host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exposure is limited to the subset of wikis where this optional extension is installed and enabled.
Reflected cross-site scripting in the MediaWiki Cargo extension, affecting all versions through 3.9.4, allows an unauthenticated attacker to inject script that executes in the browser of any wiki user who follows a crafted link. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation requires victim interaction - the target must open the malicious URL - and impact is limited to the victim's session on the affected wiki, with the scope change reflecting that the injected content can affect resources beyond the vulnerable component. No public exploit code has been identified and there is no CISA KEV entry: no public exploit identified at time of analysis. Exposure is confined to wikis that have installed and enabled Cargo, a non-core, separately deployed extension, and the Cargo query/reporting functionality must be reachable.
Stored cross-site scripting (XSS) in the MediaWiki Cargo extension through version 3.9.4 allows attackers to inject persistent malicious scripts into wiki pages that execute in the browsers of users viewing the content. The flaw requires the ability to save content that populates Cargo-stored data (typically an authenticated editor, though open wikis with anonymous editing may also be vulnerable) and user interaction from a victim. The Wikimedia Foundation reported the issue, but no public exploit code has been identified, and no vendor patch is yet available.
Information disclosure in the MediaWiki WikiLambda extension - the software behind Wikifunctions - before version 1.47.0 lets remote, unauthenticated attackers reach functionality that should be constrained by access-control lists, exposing limited, low-sensitivity data. Exploitation requires a reachable wiki with WikiLambda installed and carries high attack complexity (CVSS v4.0 2.9; assessed CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N), meaning it likely hinges on a specific request pattern, function state, or race that defeats the intended ACL check rather than working against arbitrary default requests. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; combined with confidentiality-only impact and the specialized, not-widely-deployed nature of the extension, this is a low-priority issue by every available signal.
Reflected cross-site scripting in Semantic MediaWiki 7.0.0 through 7.1.0 lets an unauthenticated attacker execute arbitrary script in a victim's browser on the wiki origin by tricking them into opening a crafted Special:Ask link carrying a forged cursor pagination token. The cursor parameter added in 7.0.0 is an unsigned base64url-encoded JSON blob, so its sort_prop and sort_order fields are fully attacker-controlled; when they mismatch the request's sort=/order= values, the resulting error string is interpolated into Query::addErrors() and rendered as raw HTML by Html::errorBox(), bypassing the message-layer sanitization that normally protects SMW error output. Exploitation requires victim interaction (clicking the link) and is aided by the absence of a Content-Security-Policy on responses, which permits inline script to run; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the maintainer advisory documents a browser-confirmed reproduction, and the CVSS 3.1 score is 6.1 with a scope change. Upgrading to 7.2.0 removes the vulnerability.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier lets an unauthenticated remote attacker inject arbitrary markup into the query debug output rendered on Special:Ask, executing JavaScript in the browser of a victim who follows a crafted link. No account, privilege, or attacker-created wiki content is required: the predefined text-type properties such as Text (_txt) that ship on every default install satisfy the property-type condition the payload needs, so a URL like Special:Ask?q=[[Text::<script>...</script>]]&debug=1 is sufficient. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 base score, reflecting a scope-changing, low-impact script injection that depends on user interaction and is therefore not self-propagating or wormable; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing). Vendor-released patch: 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows unauthenticated attackers to inject arbitrary HTML markup into the Special:Ask table output by abusing the `sep` (separator) parameter, which was inserted verbatim into the HTML that joins a table cell's values. Because the same unsanitized table HTML is produced for the raw request output (request_type=raw), no authentication is needed to reach the injection, though exploitation is limited by user interaction: a victim must be induced to load a crafted query URL for the payload to execute in their browser. The issue is correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) as a moderate-severity reflected XSS; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows an attacker to inject script into the Special:SearchByProperty page through the `property` and `value` query parameters, executing arbitrary JavaScript in the browser of any wiki user lured to a crafted URL. Rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw needs no authentication to construct or deliver the malicious link but does require victim interaction (UI:R), and impact is confined to the victim's browser session with no server-side code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor released a fix in SMW 7.2.0 that escapes both the reflected form value and the derived error messages.
Reflected cross-site scripting (CWE-79) in Semantic MediaWiki 7.1.0 and earlier allows a crafted URL to execute script in a victim's browser session; the flaw is reached through the Special:Ask result printer when it is invoked with headers=plain and an attacker-controlled mainlabel value, which is written into the table header (<th>) through a raw HTML path instead of being escaped for the output context. The vulnerability is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to craft the link, but exploitation depends on the victim opening the malicious URL (user interaction is required) and impact scales with the victim's wiki privileges. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Semantic MediaWiki 7.2.0, so deployments on 7.1.0 or earlier that expose Special:Ask queries are the realistic exposure.
Deserialization of untrusted data in MediaWiki's wiki import subsystem and logging infrastructure exposes installations to PHP object injection, with high integrity impact on affected systems. Specifically, the WikiImporter, WikiRevision, and LogEntryBase components process attacker-controlled serialized data without sufficient validation, allowing a high-privileged authenticated user to trigger unintended object instantiation or code execution paths. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; however, vendor-confirmed patches are available in releases 1.43.9, 1.44.6, 1.45.4, and 1.46.0.
Authentication API endpoints and Special pages in MediaWiki expose low-severity confidentiality and integrity weaknesses exploitable by unauthenticated remote attackers who can induce victim user interaction. Five files spanning account-linking and credential management operations - ApiChangeAuthenticationData, ApiLinkAccount, ApiRemoveAuthenticationData, SpecialLinkAccounts, and SpecialUnlinkAccounts - are affected across all MediaWiki releases prior to the fixed branches 1.43.9, 1.44.6, 1.45.4, and the forthcoming 1.46.0. No public exploit code and no active exploitation have been identified at time of analysis; real-world risk is constrained by the user-interaction prerequisite and the limited impact scope.
Cross-site scripting in Wikimedia Foundation MediaWiki and the CentralAuth extension allows authenticated low-privileged users to inject malicious scripts into rendered wiki pages or API output through unsanitized input in API formatting, ResourceLoader module handling, page display hooks, and permission change log formatting. Affected versions span all releases of both products prior to the 1.46.0, 1.45.4, 1.44.6, and 1.43.9 patch series. No public exploit code or CISA KEV listing has been identified at time of analysis, though the five affected PHP files suggest a broad attack surface across core MediaWiki subsystems.
Information disclosure in MediaWiki's core parser component (includes/Parser/Parser.php) allows authenticated low-privilege users, under conditions requiring user interaction, to obtain sensitive information not intended for their access level. All MediaWiki branches are affected up to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0, covering a broad installation base including self-hosted wikis worldwide. No public exploit code exists and no active exploitation has been confirmed at time of analysis; however, the provided CVSS 4.0 vector contains a contradictory zero-impact scoring that warrants independent verification against the upstream advisory.
Cross-site scripting in MediaWiki's JavaScript API client layer (resources/src/mediawiki.Api/index.js) allows network-accessible, unauthenticated attackers to inject malicious scripts that execute in a victim's browser upon user interaction. All MediaWiki deployments prior to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected, covering a broad range of wiki installations worldwide. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of authentication requirement elevate concern for public-facing deployments.
Sensitive information exposure in MediaWiki's InfoAction.php allows unauthenticated remote actors to obtain restricted page metadata through the 'Info' action endpoint. All MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected across all deployment configurations. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and lack of authentication requirements make opportunistic discovery straightforward for any actor who can reach the wiki.
Cross-site scripting vulnerabilities across multiple log formatter and language components in MediaWiki allow authenticated low-privilege users to inject malicious JavaScript that executes in the browser of any user who views affected log pages or the SpecialVersion special page. The vulnerability spans seven PHP files covering block, patrol, rename-user, and tag log formatters, the base LogFormatter, the Language class, and SpecialVersion - indicating widespread unsanitized output rendering in administrative and logging interfaces. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the breadth of affected components and the multiple concurrent fix branches (1.43.9, 1.44.6, 1.45.4, 1.46.0) signal a significant audit-driven remediation effort.
Insufficient permission enforcement in MediaWiki's user query API endpoints allows low-privileged authenticated users to access sensitive user information - such as group memberships or account details - that permission controls should restrict. The vulnerability spans four source files: ApiQueryAllUsers.php, ApiQueryUsers.php, PermissionManager.php, and UserGroupManager.php, indicating that the flaw lies in how permission checks are applied (or bypassed) when the API serializes user data. No public exploit code exists and the CVSS 4.0 score of 2.1 reflects the constrained real-world exploitability. No confirmed active exploitation (CISA KEV) has been reported.
Information disclosure in MediaWiki's ApiUserrights.php exposes sensitive user rights data to authenticated actors who should not have access to it. All MediaWiki installations running versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected. The CVSS 4.0 score of 5.1 with low confidentiality impact (VC:L) reflects a bounded but real data leakage risk; no public exploit identified at time of analysis.
Cross-site scripting in MediaWiki's ApiSandbox component (ApiSandboxLayout.js) allows an authenticated attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted ApiSandbox page. Only MediaWiki 1.46.0-rc.0 is confirmed affected; the 1.46.0 stable release resolves the flaw, meaning real-world exposure is limited to deployments running the release candidate. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in MediaWiki's Special:Block Vue.js component allows a high-privileged user - such as a wiki administrator - to inject malicious scripts that execute in the browsers of other users who subsequently view the affected block interface output. The vulnerability is isolated to the `SpecialBlock.Vue` frontend component, gating exploitation behind administrative access. No public exploit has been identified at time of analysis, and no patch version has been confirmed from available data.
MediaWiki's article page rendering code in includes/Page/Article.php exposes limited confidential content to unintended users, constituting an information disclosure under CWE-668 (Exposure of Resource to Wrong Sphere). All MediaWiki deployments running versions prior to 1.43.7, 1.44.4, or 1.45.2 are affected, but exploitation is constrained by high privilege requirements, high attack complexity, and specific preconditions. With a CVSS 4.0 score of 2.0, an EPSS of 0.04% (12th percentile), no CISA KEV listing, and SSVC exploitation status of 'none,' this is a low-priority item suitable for routine patching; no public exploit has been identified at time of analysis.
MediaWiki's SpecialUserRights.php exposes sensitive information to authenticated low-privilege users across versions prior to 1.43.7, 1.44.4, and 1.45.2. The vulnerability resides in the user rights management special page, where insufficient access controls allow a logged-in actor with minimal privileges to read confidential data - likely user group memberships, rights assignments, or related administrative details - that should be restricted to privileged operators. No public exploit exists and SSVC rates exploitation as none, placing this firmly in low-urgency patch territory despite its network-accessible attack vector.
MediaWiki versions before 1.43.7, 1.44.4, and 1.45.2 expose sensitive information to unauthorized actors through improper handling in the Skin.php component. The vulnerability requires authenticated user access and user interaction (CVSS:4.0/AV:N/AC:H/PR:L/UI:P), resulting in low confidentiality impact. With an EPSS score of 2.1 and no evidence of active exploitation, this poses limited real-world risk but should be patched as part of routine maintenance.
Exposure of sensitive information in Wikimedia Foundation MediaWiki allows remote unauthenticated attackers to access unauthorized data via network requests against affected versions before 1.43.7, 1.44.4, and 1.45.2. The vulnerability has low confidentiality impact with CVSS 5.5 and evidence of proof-of-concept code, though no active exploitation in CISA KEV has been confirmed at time of analysis.
MediaWiki before versions 1.43.7, 1.44.4, and 1.45.2 exposes sensitive information to unauthorized actors through a vulnerability requiring user interaction. The flaw allows information disclosure via network access without authentication, though impact is limited (CVSS 1.3) and requires user participation to trigger. Vendor-released patches are available across all affected major versions.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php.
Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php.
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php.
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. [CVSS 6.1 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. [CVSS 4.7 MEDIUM]
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.
Wikimedia Foundation Mediawiki - DiscussionTools Extension is affected by improper neutralization of special elements used in an expression language statement.
Insufficient access controls in the MediaWiki CampaignEvents extension (versions 1.39, 1.43, 1.44, 1.45) permit unauthenticated attackers to perform unauthorized actions by bypassing privilege checks. An attacker could exploit this vulnerability to gain elevated privileges within the extension without proper authorization. A patch is available to remediate this low-impact authorization flaw.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.
Cross-site scripting (XSS) in MediaWiki's GrowthExperiments extension (versions 1.39, 1.43, 1.44, 1.45) allows authenticated attackers to inject malicious scripts through improper input validation, with public exploit code available. An attacker with user privileges can exploit this vulnerability to perform actions on behalf of other users or steal sensitive information due to the low complexity attack vector and user interaction requirement. A patch is available for affected installations.
Improper output encoding in MediaWiki's Approved Revs extension through magic word replacement allows unauthenticated attackers to manipulate input data and conduct content injection attacks. Affected versions 1.39, 1.43, 1.44, and 1.45 are vulnerable to this network-accessible flaw that requires user interaction, and public exploit code exists. A patch is available to remediate the vulnerability.
Cross-site scripting (XSS) in MediaWiki's Wikibase extension allows authenticated attackers to inject malicious scripts through improper input handling during page generation, affecting versions 1.39, 1.43, 1.44, and 1.45. Exploitation requires user interaction and results in limited confidentiality and integrity impact within the affected application context. A patch is available and public exploit code exists for this vulnerability.
Mediawiki-Extensions-Uploadwizard versions up to 1.39 is affected by cross-site scripting (xss) (CVSS 6.1).
Cross-site scripting (XSS) in MediaWiki's ProofreadPage extension (versions 1.39, 1.43, 1.44, 1.45) allows attackers to inject malicious scripts through improper input sanitization during web page generation. Public exploit code exists for this vulnerability, which requires user interaction to trigger. A patch is available to remediate the issue.