Skip to contentWikimedia Foundation vulnerabilities
Newest
- mediawikiHTML rest endpoint needs PoolCounter and proper parser cache checkCVE-2025-61634Fix available0.0 None
- mediawikiCodex Special:Block vulnerable to message key XSSCVE-2025-61636Fix available0.0 None
- wikimedia foundation mediawikiWith MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockListCVE-2025-6589Fix available2.1 Low
- wikimedia foundation abusefilterCreating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLogCVE-2025-6592Fix available2.1 Low
- wikimedia foundation vectorVector inserts portlet labels as HTML, allowing for stored XSS through system messagesCVE-2025-6596Fix available0.0 None
- wikimedia foundation mediawikiAutoblocks from global account suppressions are publicly visibleCVE-2025-6927Fix available2.3 Low
- the wikimedia foundation mediawiki - campaignevents extension, wikimedia campaignevents +1 moreCampaignEvents API missing authorization exposes meeting and chat URLsCVE-2026-08175.3 Medium
- wikimedia foundation mediawiki - uploadwizard extension, wikimedia mediawiki-extensions-uploadwizard +1 moreMultiple stored i18n/message-key XSSes in UploadWizardCVE-2026-06716.1 Medium
- wikimedia foundation mediawiki - proofreadpage extension, wikisource proofread page +1 moreStored XSS through a system message and a user-provided parameter in ProofreadPageCVE-2026-06706.1 Medium
- css project css, wikimedia foundation mediawiki - css extension +1 morePath Traversal vulnerability in CSS extension on certain web serversCVE-2026-06697.5 High
- wikimedia foundation mediawiki - visualdata extension, wikisphere visualdata +1 moreVisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputCVE-2026-06685.3 Medium
- mediawikiAction API xslt option allows JavaScript execution by administrators who are not interface administratorsCVE-2025-67484Fix available0.0 None
- wikimedia foundation luasandbox, scribunto +1 moreLua segfault in unpack()CVE-2025-67482Fix available1.7 Low
- mediawikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesCVE-2025-67481Fix available0.0 None
- mediawikilist=allrevisions can be used to bypass Extension:LockdownCVE-2025-67480Fix available0.0 None
- wikimedia foundation cite, mediawiki +1 moreMagic word replacement in legacy parser allows using reserved data attributes through wikitextCVE-2025-67479Fix available0.0 None
- mediawiki checkuserWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"CVE-2025-67478Fix available0.0 None
- mediawikiStored XSS through edit summaries in MW CoreCVE-2025-67475Fix available0.0 None
- ancorathemes echoWordPress Echo theme <= 1.15.0 - Local File Inclusion vulnerabilityCVE-2025-534328.1 High
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreXSS when pasting into VECVE-2025-61656Fix available0.0 None
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreStored XSS through system messages in VisualEditorCVE-2025-61655Fix available0.0 None
- wikimedia foundation textextractsExtension:TextExtracts does not check for authorizeRead when returning extractsCVE-2025-61653Fix available2.7 Low
- mediawikiWatchlist group mode reveals authors of edits with hidden authorshipCVE-2025-61646Fix available1.2 Low
- mediawikiEventStreams publishes suppressed recent change entries that are suppressed from their creationCVE-2025-61643Fix available2.7 Low
- mediawikiAPI list=allpages with maxsize is making really slow queriesCVE-2025-61641Fix available1.7 Low
- mediawikiStored XSS through system messages in Special:RecentChangesLinked (MW Core)CVE-2025-61640Fix available0.0 None
- mediawikiSuppressed blocked IP is visible in Special:BlockList, RC, and other placesCVE-2025-61639Fix available1.7 Low
- mediawiki, wikimedia parsoid +1 moreSanitizer::validateAttributes data-XSSCVE-2025-61638Public exploitFix available0.0 None
- wikimedia foundation confirmeditAdd rate limiting to ApiFancyCaptchaReloadCVE-2025-61635Fix available0.0 None
- mediawikiStored i18n XSS exposed by security patch for T402077CVE-2025-11261Fix available0.0 None
- wikimedia foundation oathauthReauth for enabling 2FA can be bypassed by submitting a formCVE-2025-11173Fix available0.0 None
- wikimedia foundation wikipedia previewWordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerabilityCVE-2025-527386.5 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS through wikitext in CargoCVE-2025-62671Fix available6.9 Medium
- the wikimedia foundation mediawiki - uploadwizard extensionStored XSS through a system message in UploadWizardCVE-2025-626636.9 Medium
- wikimedia foundation mediawiki - skin:blueskyStored XSS through system messages in Skin:BlueSkyCVE-2025-626656.9 Medium
- wikimedia foundation mediawiki - titleicon extensionTitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser functionCVE-2025-73635.4 Medium
- wikimedia foundation mediawiki - msupload extensionMsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system messageCVE-2025-73625.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized messageCVE-2025-534795.4 Medium
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messagesCVE-2025-534805.4 Medium
- wikimedia foundation mediawiki - mediasearch extensionStored XSS in MediaSearchCVE-2025-534965.4 Medium
- wikimedia foundation mediawiki - wikihiero extensionStored XSS in WikiHieroCVE-2025-534886.1 Medium
- wikimedia foundation mediawiki - abusefilter extensionLack of Audit Logging in AbuseFilterCVE-2025-534985.3 Medium
- wikimedia foundation mediawiki - abusefilter extensionUnauthorized Inspection of Protected Variables in AbuseFilterCVE-2025-534999.1 Critical
- wikimedia foundation mediawiki - abusefilter extensionUnauthorized Disclosure of IP Reputation in AbuseFilterCVE-2025-534959.1 Critical
- the wikimedia foundation mediawiki - checkuser extensionCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesCVE-2025-534785.4 Medium
- wikimedia foundation mediawiki - relatedarticles extensionStored XSS in RelatedArticlesCVE-2025-534975.4 Medium
- wikimedia foundation mediawiki - flaggedrevs extensionXSS in FlaggedRevsCVE-2025-534915.4 Medium
- the wikimedia foundation mediawiki - approvedrevs extensionApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messagesCVE-2025-534875.4 Medium
- wikimedia foundation mediawiki - quiz extensionStored XSS in QuizCVE-2025-70575.4 Medium
- wikimedia foundation mediawiki - wikicategorytagcloud extensionWikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser functionCVE-2025-534865.4 Medium
- Show moreLoading…