Skip to contentWikimedia Foundation Mediawiki vulnerabilities
- mediawikiImporting leaks IP address of importer via EventStreamsCVE-2025-674761.3 Low
- mediawikiStored XSS through a system message in Special:ApiSandboxCVE-2025-67477Fix available0.0 None
- mediawikiCodexTablePager has i18n XSSCVE-2025-616450.0 None
- wikimedia foundation mediawikii18n XSS through Special:WatchlistCVE-2025-616440.0 None
- mediawikiStored XSS through system messages in MW CoreCVE-2025-61637Fix available0.0 None
- mediawikiStored XSS through system messages provided to CodexHtmlFormsCVE-2025-61642Fix available0.0 None
- mediawikiHTML rest endpoint needs PoolCounter and proper parser cache checkCVE-2025-61634Fix available0.0 None
- mediawikiCodex Special:Block vulnerable to message key XSSCVE-2025-61636Fix available0.0 None
- wikimedia foundation mediawikiWith MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockListCVE-2025-6589Fix available2.1 Low
- wikimedia foundation mediawikiAutoblocks from global account suppressions are publicly visibleCVE-2025-6927Fix available2.3 Low
- the wikimedia foundation mediawiki - campaignevents extension, wikimedia campaignevents +1 moreCampaignEvents API missing authorization exposes meeting and chat URLsCVE-2026-08175.3 Medium
- wikimedia foundation mediawiki - uploadwizard extension, wikimedia mediawiki-extensions-uploadwizard +1 moreMultiple stored i18n/message-key XSSes in UploadWizardCVE-2026-06716.1 Medium
- wikimedia foundation mediawiki - proofreadpage extension, wikisource proofread page +1 moreStored XSS through a system message and a user-provided parameter in ProofreadPageCVE-2026-06706.1 Medium
- css project css, wikimedia foundation mediawiki - css extension +1 morePath Traversal vulnerability in CSS extension on certain web serversCVE-2026-06697.5 High
- wikimedia foundation mediawiki - visualdata extension, wikisphere visualdata +1 moreVisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputCVE-2026-06685.3 Medium
- mediawikiAction API xslt option allows JavaScript execution by administrators who are not interface administratorsCVE-2025-67484Fix available0.0 None
- mediawikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesCVE-2025-67481Fix available0.0 None
- mediawikilist=allrevisions can be used to bypass Extension:LockdownCVE-2025-67480Fix available0.0 None
- wikimedia foundation cite, mediawiki +1 moreMagic word replacement in legacy parser allows using reserved data attributes through wikitextCVE-2025-67479Fix available0.0 None
- mediawikiStored XSS through edit summaries in MW CoreCVE-2025-67475Fix available0.0 None
- mediawikiWatchlist group mode reveals authors of edits with hidden authorshipCVE-2025-61646Fix available1.2 Low
- mediawikiEventStreams publishes suppressed recent change entries that are suppressed from their creationCVE-2025-61643Fix available2.7 Low
- mediawikiAPI list=allpages with maxsize is making really slow queriesCVE-2025-61641Fix available1.7 Low
- mediawikiStored XSS through system messages in Special:RecentChangesLinked (MW Core)CVE-2025-61640Fix available0.0 None
- mediawikiSuppressed blocked IP is visible in Special:BlockList, RC, and other placesCVE-2025-61639Fix available1.7 Low
- mediawiki, wikimedia parsoid +1 moreSanitizer::validateAttributes data-XSSCVE-2025-61638Public exploitFix available0.0 None
- mediawikiStored i18n XSS exposed by security patch for T402077CVE-2025-11261Fix available0.0 None
- the wikimedia foundation mediawiki - cargo extensionStored XSS through wikitext in CargoCVE-2025-62671Fix available6.9 Medium
- the wikimedia foundation mediawiki - uploadwizard extensionStored XSS through a system message in UploadWizardCVE-2025-626636.9 Medium
- wikimedia foundation mediawiki - skin:blueskyStored XSS through system messages in Skin:BlueSkyCVE-2025-626656.9 Medium
- wikimedia foundation mediawiki - titleicon extensionTitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser functionCVE-2025-73635.4 Medium
- wikimedia foundation mediawiki - msupload extensionMsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system messageCVE-2025-73625.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized messageCVE-2025-534795.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messagesCVE-2025-534805.4 Medium
- wikimedia foundation mediawiki - mediasearch extensionStored XSS in MediaSearchCVE-2025-534965.4 Medium
- wikimedia foundation mediawiki - wikihiero extensionStored XSS in WikiHieroCVE-2025-534886.1 Medium
- wikimedia foundation mediawiki - abusefilter extensionLack of Audit Logging in AbuseFilterCVE-2025-534985.3 Medium
- wikimedia foundation mediawiki - abusefilter extensionUnauthorized Inspection of Protected Variables in AbuseFilterCVE-2025-534999.1 Critical
- wikimedia foundation mediawiki - abusefilter extensionUnauthorized Disclosure of IP Reputation in AbuseFilterCVE-2025-534959.1 Critical
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesCVE-2025-534785.4 Medium
- wikimedia foundation mediawiki - relatedarticles extensionStored XSS in RelatedArticlesCVE-2025-534975.4 Medium
- wikimedia foundation mediawiki - flaggedrevs extensionXSS in FlaggedRevsCVE-2025-534915.4 Medium
- the wikimedia foundation mediawiki - approvedrevs extensionApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messagesCVE-2025-534875.4 Medium
- wikimedia foundation mediawiki - quiz extensionStored XSS in QuizCVE-2025-70575.4 Medium
- wikimedia foundation mediawiki - wikicategorytagcloud extensionWikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser functionCVE-2025-534865.4 Medium
- wikimedia foundation mediawiki - urlshortener extensionStored XSS in UrlShortenerCVE-2025-70566.3 Medium
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesCVE-2025-534857.5 High
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputCVE-2025-534849.8 Critical
- the wikimedia foundation mediawiki - securepoll extensionSecurePoll: Multiple admin actions vulnerable to Cross-Site Request ForgeryCVE-2025-534838.8 High
- wikimedia foundation mediawiki - ipinfo extensionIPInfo: Message key XSS through several IPInfo messages in infobox and popupCVE-2025-534826.1 Medium
- Show moreLoading…