What is CVE-2025-32699?

CVE-2025-32699 is a vulnerability in Wikimedia Foundation Mediawiki, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Published 2025-04-10.

Is CVE-2025-32699 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Wikimedia Foundation Mediawiki

CVE-2025-32699

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

EPSS: 0.003 (23.2th percentile) — read the EPSS interpretation.

Affected products

Wikimedia Foundation Mediawiki — versions 0
Wikimedia Foundation Parsoid — versions 0

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

w4zu/Debian_

References

c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-32699?: CVE-2025-32699 is a vulnerability in Wikimedia Foundation Mediawiki, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Published 2025-04-10.
Is CVE-2025-32699 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.