CVE-2026-39840

CSS injection in multiple Cargo display formats

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki-cargo Extension

CVE-2025-61644

i18n XSS through Special:Watchlist

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6593

"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6927

Autoblocks from global account suppressions are publicly visible

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php. This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67479

Magic word replacement in legacy parser allows using reserved data attributes through wikitext

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Wikimedia

Products

Cite Mediawiki

CVE-2025-6597

MediaWiki should not consider autocreation as login for the purposes of security reauthentication

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6594

XSS in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6591

HTML injection in API action=feedcontributions output from i18n message

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6590

Complete content leak of private wikis due to PasswordReset Wikitext injection in error message

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-6589

With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-62702

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Pagetriage

CVE-2025-62697

Improperly sanitized style parameter in LanguageSelector

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Languageselector

CVE-2025-11175

DiscussionTools should use better regex

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wikimedia

Products

Mediawiki-discussiontools Extension

CVE-2025-67476

Importing leaks IP address of importer via EventStreams

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67480

list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67484

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67475

Stored XSS through edit summaries in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67477

Stored XSS through a system message in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67481

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki

CVE-2025-67483

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Mediawiki Mediawiki