p PatchFirst

CVE-2025-49576

CVE-2025-49576 · Citizen allows stored XSS in search no result messages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mediawiki-skins-citizen

    Versions
    • >= a0296afaedbe1a277337a2d8f1da83cb3a79b9ab, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd: Affected
    • >= 2.31.0, < 3.3.1: Affected

    No fix published

  • starcitizentools/citizen-skin Packagist

    Versions
    • v2.31.0
    • v2.32.0
    • v2.33.0
    • v2.34.0
    • v2.35.0
    • v2.36.0
    • v2.37.0
    • v2.38.0
    • v2.38.1
    • v2.38.2
    • v2.38.3
    • v2.39.0
    • v2.39.1
    • v2.39.2
    • v2.39.3
    • v2.39.4
    • v2.40.0
    • v2.40.1
    • v2.40.2
    • v3.0.0
    • v3.1.0
    • v3.2.0
    • v3.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.31.0, < 3.3.1

    Update to 3.3.1

Original sources

Check your server →