Skip to contentThe Wikimedia Foundation vulnerabilities
Newest
- the wikimedia foundation mediawiki - approvedrevs extension, wikiworks approved revs +1 moreApprovedRevs allows bypassing the inline CSS sanitizerCVE-2026-227122.3 Low
- growth growthexperiments, the wikimedia foundation mediawiki - growthexperiments extension +1 moreStored XSS through edit summaries in GrowthExperimentsCVE-2026-227132.3 Low
- the wikimedia foundation mediawiki - monaco skini18n XSS, DoS and config SQLI in MonacoCVE-2026-227142.3 Low
- the wikimedia foundation mediawiki - wikibase extension, wikimedia wikibase +1 moreStored XSS through autocomment system messages in WikibaseCVE-2026-227102.3 Low
- the wikimedia foundation mediawiki cookieconsent extensionThe CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectorsCVE-2025-626592.1 Low
- the wikimedia foundation mediawiki - thanks extension, mediawiki - growth experiments extensionDo permission checking when getting counts of global and local edits, new articles and thanksCVE-2025-626616.9 Medium
- the wikimedia foundation mediawiki - lockdown extensionThe compare API module breaks Extension:LockdownCVE-2025-1200410.0 Critical
- the wikimedia foundation mediawiki - wikistoriesStored XSS through system messagesCVE-2025-627016.9 Medium
- the wikimedia foundation mediawiki - pagetriage extensionStored XSS through system messagesCVE-2025-627026.9 Medium
- the wikimedia foundation mediawiki - wikilove extensionStored XSS through a system messageCVE-2025-626946.9 Medium
- the wikimedia foundation mediawiki - wikilambda extensionStored XSS through system messagesCVE-2025-626956.9 Medium
- the wikimedia foundation mediawiki foundation - springboard extensionMultiple critical security issues in SpringboardCVE-2025-626966.9 Medium
- the wikimedia foundation mediawiki - translate extensionSpecial:Translate tool does not use the correct IP and User-Agent in the CheckUser toolCVE-2025-626996.9 Medium
- the wikimedia foundation mediawiki watchanalytics extensionSQL injection in WatchAnalytics through Special:ClearPendingReviewsCVE-2025-626587.5 High
- the wikimedia foundation mediawiki pageforms extensionStored XSS through system messages in PageFormsCVE-2025-626575.8 Medium
- the wikimedia foundation mediawiki globalblocking extensionGlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSSCVE-2025-626565.8 Medium
- the wikimedia foundation mediawiki - languageselector extensionImproperly sanitized style parameter in LanguageSelectorCVE-2025-626978.8 High
- the wikimedia foundation mediawiki - externalguidanceStored XSS through system messages in ExternalGuidanceCVE-2025-626986.9 Medium
- the wikimedia foundation mediawiki - multiboilerplate extensionmasteStored XSS through a system message in MultiBoilerplateCVE-2025-627006.9 Medium
- the wikimedia foundation mediawiki - lastmodified extensionStored XSS through system messages in LastModifiedCVE-2025-626936.9 Medium
- the wikimedia foundation mediawiki - securepoll extensionStored XSS through a system message in SecurePollCVE-2025-119376.9 Medium
- the wikimedia foundation mediawiki - cirrussearch extensionDoS vector through the cirrusbuilddoc query APICVE-2025-626666.9 Medium
- the wikimedia foundation mediawiki - growthexperiments extensionStored XSS through article extracts in GrowthExperimentsCVE-2025-626676.9 Medium
- the wikimedia foundation mediawiki - growthexperiments extensionInsufficient permission checks in action=growthsetmentorCVE-2025-626686.9 Medium
- the wikimedia foundation mediawiki - centralauth extensionUserInfoCard: activeLocalBlocksAllWikis does not do permissions checksCVE-2025-626696.9 Medium
- the wikimedia foundation mediawiki - flexdiagrams extensionStored XSS through a system message in FlexDiagramsCVE-2025-626706.9 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS through wikitext in CargoCVE-2025-62671Fix available6.9 Medium
- the wikimedia foundation mediawiki - advancedsearch extensionStored XSS through system messages in AdvancedSearchCVE-2025-626626.9 Medium
- the wikimedia foundation mediawiki - uploadwizard extensionStored XSS through a system message in UploadWizardCVE-2025-626636.9 Medium
- the wikimedia foundation mediawiki - imagerating extensionStored XSS through a system message in ImageRatingCVE-2025-626646.9 Medium
- the wikimedia foundation mediawiki cargo extensionSQL injection in Cargo via Special:CargoExportCVE-2025-626552.1 Low
- the wikimedia foundation mediawiki quizgame extensionStored XSS through system messages in QuizGameCVE-2025-626542.0 Low
- the wikimedia foundation mediawiki pollny extensionStored XSS through system messages in PollNYCVE-2025-626532.0 Low
- the wikimedia foundation mediawiki webauthn extensionStored XSS in WebAuthn key nameCVE-2025-626525.8 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized messageCVE-2025-534795.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messagesCVE-2025-534805.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesCVE-2025-534785.4 Medium
- the wikimedia foundation mediawiki - approvedrevs extensionApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messagesCVE-2025-534875.4 Medium
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesCVE-2025-534857.5 High
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputCVE-2025-534849.8 Critical
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Multiple admin actions vulnerable to Cross-Site Request ForgeryCVE-2025-534838.8 High
- jly campaignevents, the wikimedia foundation mediawiki - campaignevents extension +1 moreMultiple XSS in CampaignEventsCVE-2025-534905.6 Medium
- the wikimedia foundation mediawiki - centralauth extensionSecurity Authentication Bypass in CentralAuthCVE-2025-6926Fix available8.8 High
- the wikimedia foundation mediawiki - extension:simplecalendarXSSes in Extension:SimpleCalendarCVE-2025-320776.9 Medium
- the wikimedia foundation mediawiki - version compare extensionXSSes and potential RCE in Special:VersionCompareCVE-2025-320786.9 Medium
- the wikimedia foundation mediawiki - growthexperimentsSaving the right content to MediaWiki:GrowthMentors.json can take down the siteCVE-2025-320796.5 Medium
- the wikimedia foundation mediawiki - mobile frontend extensionCross-origin data leak in mobilefrontend via lazy load imagesCVE-2025-320806.9 Medium
- the wikimedia foundation mediawiki - visual data extensionEvil regex used to process user-provided data in VisualDataCVE-2025-320766.9 Medium
- the wikimedia foundation mediawiki core - feed utilsHTML injection in feed output from i18n messageCVE-2025-32072Fix available6.9 Medium
- the wikimedia foundation mediawiki - html tagsSystem message XSS in HTMLTagsCVE-2025-320735.4 Medium
- Show moreLoading…