PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 3

Vulnerabilities published for mediawiki in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 164

CVE-2025-67481
Low · CVSS 0EPSS 0.26%No fix published
mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67482
Low · CVSS 1.7EPSS 0.33%No fix published
Lua segfault in unpack()
Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.
mediawiki Operating systems
Published February 3, 2026Updated March 2, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67483
Low · CVSS 0EPSS 0.26%No fix published
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67484
Low · CVSS 0EPSS 0.45%No fix published
Action API xslt option allows JavaScript execution by administrators who are not interface administrators
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67480
Low · CVSS 0EPSS 0.25%No fix published
list=allrevisions can be used to bypass Extension:Lockdown
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67475
Low · CVSS 0EPSS 0.25%No fix published
Stored XSS through edit summaries in MW Core
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67476
Low · CVSS 1.3EPSS 0.29%No fix published
Importing leaks IP address of importer via EventStreams
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated March 2, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67477
Low · CVSS 0EPSS 0.25%No fix published
Stored XSS through a system message in Special:ApiSandbox
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67478
Low · CVSS 0EPSS 0.35%No fix published
Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 2, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-67479
Low · CVSS 0EPSS 0.31%No fix published
Magic word replacement in legacy parser allows using reserved data attributes through wikitext
Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 2, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61654
Low · CVSS 0EPSS 0.36%No fix published
UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks
Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2025-61655
Low · CVSS 0EPSS 0.17%No fix published
Stored XSS through system messages in VisualEditor
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61656
Low · CVSS 0EPSS 0.18%No fix published
XSS when pasting into VE
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61657
Low · CVSS 0EPSS 0.29%No fix published
CVE-2025-61657
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61653
Low · CVSS 2.7EPSS 0.39%No fix published
Extension:TextExtracts does not check for authorizeRead when returning extracts
Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61652
Low · CVSS 2.7EPSS 0.3%No fix published
Action API discussiontoolspageinfo does not check for authorizeRead for the page
Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-11173
Low · CVSS 0EPSS 0.4%No fix published
Reauth for enabling 2FA can be bypassed by submitting a form
Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2025-61645
Low · CVSS 0EPSS 0.24%No fix published
CodexTablePager has i18n XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61646
Low · CVSS 1.2EPSS 0.27%No fix published
Watchlist group mode reveals authors of edits with hidden authorship
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
mediawiki Operating systems
Published February 3, 2026Updated March 3, 2026
Source advisory 1 ↗Source advisory 2 ↗
CVE-2025-61644
Low · CVSS 0EPSS 0.29%No fix published
i18n XSS through Special:Watchlist
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.
mediawiki Operating systems
Published February 2, 2026Updated February 3, 2026
Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

mediawiki vulnerabilities · Page 3

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Lua segfault in unpack()

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

list=allrevisions can be used to bypass Extension:Lockdown

Stored XSS through edit summaries in MW Core

Importing leaks IP address of importer via EventStreams

Stored XSS through a system message in Special:ApiSandbox

Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

Magic word replacement in legacy parser allows using reserved data attributes through wikitext

UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks

Stored XSS through system messages in VisualEditor

XSS when pasting into VE

CVE-2025-61657

Extension:TextExtracts does not check for authorizeRead when returning extracts

Action API discussiontoolspageinfo does not check for authorizeRead for the page

Reauth for enabling 2FA can be bypassed by submitting a form

CodexTablePager has i18n XSS

Watchlist group mode reveals authors of edits with hidden authorship

i18n XSS through Special:Watchlist

Check your server