XSS in Wikimedia Foundation Mediawiki - Titleicon Extension
CVE-2025-7363
The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript. This issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Wikimedia Foundation Mediawiki - Titleicon Extension — versions 1.39.x, 1.42.x, 1.43.x
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-7363?
- CVE-2025-7363 is a medium-severity vulnerability in Wikimedia Foundation Mediawiki - Titleicon Extension, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-07-08.
- How severe is CVE-2025-7363?
- Medium severity. CVSS v3 base score is 5.4 out of 10.