XSS in Wikimedia Foundation Vector

CVE-2025-61657

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (16.1th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References