Wikimedia vulnerabilities

Products

• Mediawiki-cargo 3
• Wikidata Query Gui 3
• Mediawiki-extensions-css 2
• Parsoid 2
• Wikimedia-extensions-css 2

Newest

• wikimedia scribunto Memory leak in Scribunto causes runJobs.php to run out of memory CVE-2026-34089 2.3 LowMay 11, 2026
• the wikimedia foundation mediawiki - campaignevents extension, wikimedia campaignevents +1 more CampaignEvents API missing authorization exposes meeting and chat URLs CVE-2026-0817 5.3 MediumJanuary 9, 2026
• the wikimedia foundation mediawiki - wikibase extension, wikimedia wikibase +1 more Stored XSS through autocomment system messages in Wikibase CVE-2026-22710 2.3 LowJanuary 8, 2026
• wikimedia foundation mediawiki - uploadwizard extension, wikimedia mediawiki-extensions-uploadwizard +1 more Multiple stored i18n/message-key XSSes in UploadWizard CVE-2026-0671 6.1 MediumJanuary 8, 2026
• mediawiki, wikimedia parsoid +1 more Sanitizer::validateAttributes data-XSS CVE-2025-61638 Public exploitFix available 0.0 NoneOctober 31, 2025
• the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 more Path traversal when loading stylesheets CVE-2024-47841 EPSS 34.6% 6.9 MediumOctober 5, 2024
• the wikimedia foundation mediawiki - apex skin, wikimedia apex, mediawiki-apex skin +2 more Stored XSS through sidebar in Apex skin CVE-2024-47840 6.9 MediumOctober 5, 2024
• mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 more Various XSSes found in Cargo CVE-2024-47847 Fix available 6.9 MediumOctober 5, 2024
• mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 more Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection CVE-2024-47846 6.9 MediumOctober 5, 2024
• mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 more Backticks can allow the usage of not-allowed SQL functions CVE-2024-47849 8.8 HighOctober 5, 2024
• the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 more CSS sanitizer used incorrectly, and is easily bypassed CVE-2024-47845 6.9 MediumOctober 5, 2024
• the wikimedia foundation mediawiki - pagetriage, wikimedia pagetriage +1 more User can review/unreview articles while blocked CVE-2024-47848 6.9 MediumOctober 4, 2024
• wikimedia mediawiki-extensions-i18ntags Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting CVE-2018-25065 3.5 LowJanuary 5, 2023
• wikimedia analytics-quarry-web Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does... CVE-2020-36324 6.1 MediumApril 21, 2021
• wikimedia parsoid Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS) CVE-2021-30458 Fix available 6.1 MediumApril 9, 2021
• wikimedia wikidata query gui ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows... CVE-2019-19327 6.1 MediumNovember 27, 2019
• wikimedia wikidata query gui ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07... CVE-2019-19328 6.1 MediumNovember 27, 2019
• wikimedia wikidata query gui In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical... CVE-2019-19329 6.1 MediumNovember 27, 2019