p PatchFirst

CVE-2025-49577

CVE-2025-49577 · Citizen allows stored XSS in preference menu headings

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mediawiki-skins-citizen

    Versions
    • >= a741639085d70c22a9f49890542a142a223bf981, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd: Affected
    • >= 2.13.0, < 3.3.1: Affected

    No fix published

  • starcitizentools/citizen-skin Packagist

    Versions
    • v2.13.0
    • v2.13.1
    • v2.13.2
    • v2.13.3
    • v2.13.4
    • v2.13.5
    • v2.14.0
    • v2.14.1
    • v2.15.0
    • v2.15.1
    • v2.16.0
    • v2.16.1
    • v2.17.0
    • v2.17.1
    • v2.17.2
    • v2.18.0
    • v2.18.1
    • v2.19.0
    • v2.20.0
    • v2.21.0
    • v2.22.0
    • v2.22.1
    • v2.23.0
    • v2.24.0
    • v2.25.0
    • v2.26.0
    • v2.27.0
    • v2.28.0
    • v2.29.0
    • v2.30.0
    • v2.31.0
    • v2.32.0
    • v2.33.0
    • v2.34.0
    • v2.35.0
    • v2.36.0
    • v2.37.0
    • v2.38.0
    • v2.38.1
    • v2.38.2
    • v2.38.3
    • v2.39.0
    • v2.39.1
    • v2.39.2
    • v2.39.3
    • v2.39.4
    • v2.40.0
    • v2.40.1
    • v2.40.2
    • v3.0.0
    • v3.1.0
    • v3.2.0
    • v3.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.13.0, < 3.3.1

    Update to 3.3.1

Original sources

Check your server →