p PatchFirst

CVE-2025-21612

CVE-2025-21612 · Cross-site Scripting in TabberTransclude in Extension:TabberNeue

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

CVSS 8.6 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mediawiki-extensions-tabberneue

    Versions
    • >= 1.9.1, < 2.7.2: Affected
    • >= d8c3db4e5935476e496d979fb01f775d3d3282e6, < f229cab099c69006e25d4bad3579954e481dc566: Affected

    No fix published

  • starcitizentools/tabber-neue Packagist

    Versions
    • v1.9.1
    • v2.1.0
    • v2.1.1
    • v2.2.0
    • v2.2.1
    • v2.2.2
    • v2.2.3
    • v2.2.4
    • v2.3.0
    • v2.4.0
    • v2.5.0
    • v2.6.0
    • v2.7.0
    • v2.7.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.9.1, < 2.7.2

    Update to 2.7.2

Original sources

Check your server →