The Wikimedia Foundation

69 CVEs across 57 The Wikimedia Foundation products. Browse The Wikimedia Foundation vulnerabilities, severities, and proof-of-concept exploits.

The Wikimedia Foundation products with known CVEs

ProductCVEs
MediaWiki - Cargo Extension4
MediaWiki - Growthexperiments Extension4
MediaWiki - Cargo3
MediaWiki - Centralauth Extension2
MediaWiki - CSS Extension2
MediaWiki - Wikilambda Extension2
MediaWiki - Wikilove Extension2
MediaWiki - Advancedsearch Extension1
MediaWiki - Ajax Poll Extension1
MediaWiki - Apex Skin1
MediaWiki - Approvedrevs Extension1
MediaWiki - Campaignevents Extension1
MediaWiki Cargo Extension1
MediaWiki - Charts Extension1
MediaWiki - Cirrussearch Extension1
MediaWiki - Confirm Account Extension1
MediaWiki Cookieconsent Extension1
MediaWiki Core - Feed Utils1
MediaWiki - Discussiontools Extension1
MediaWiki - Extension:simplecalendar1
MediaWiki - Externalguidance1
MediaWiki - Flexdiagrams Extension1
MediaWiki Foundation - Springboard Extension1
MediaWiki Globalblocking Extension1
MediaWiki - Globalwatchlist Extension1
MediaWiki - Growthexperiments1
MediaWiki - Growth Experiments Extension1
MediaWiki - HTML Tags1
MediaWiki - Imagerating Extension1
MediaWiki - Languageselector Extension1
MediaWiki - Lastmodified Extension1
MediaWiki - Lockdown Extension1
MediaWiki - Mobile Frontend Extension1
MediaWiki - Monaco Skin1
MediaWiki - Multiboilerplate Extensionmaste1
MediaWiki - Oauth Extension1
MediaWiki Pageforms Extension1
MediaWiki - Pagetriage1
MediaWiki - Pagetriage Extension1
MediaWiki Pollny Extension1
MediaWiki Quizgame Extension1
MediaWiki - Redirectmanager Extension1
MediaWiki - Score Extension1
MediaWiki - Securepoll Extension1
MediaWiki - Tabs Extension1
MediaWiki - Thanks Extension, MediaWiki - Growth Experiments Extension1
MediaWiki - Translate Extension1
MediaWiki - Uploadwizard Extension1
MediaWiki - Urlshortener Extension1
MediaWiki - Version Compare Extension1
The Wikimedia Foundation CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-14363Critical9.82026-07-01Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo…
CVE-2026-58517Medium4.32026-07-01Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This iss…
CVE-2026-14358Medium6.12026-07-01Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension all…
CVE-2026-58521Critical9.82026-07-01Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo…
CVE-2026-58520Medium6.12026-07-01URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. T…
CVE-2026-58519Medium5.42026-07-01Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo…
CVE-2026-58518Medium6.32026-07-01Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issu…
CVE-2026-399362026-04-07Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allo…
CVE-2026-399352026-04-07Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Exten…
CVE-2026-399372026-04-07Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resourc…
CVE-2026-399342026-04-07Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time…
CVE-2026-399332026-04-07Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Exte…
CVE-2026-227112026-04-07Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The…
CVE-2025-111752026-01-30Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundatio…
CVE-2026-227142026-01-09Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin a…
CVE-2026-22713Medium5.42026-01-09Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperim…
CVE-2026-22712Medium4.32026-01-09Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Ext…
CVE-2026-22710Medium5.42026-01-09Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Exte…
CVE-2025-626592025-10-22Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent e…
CVE-2025-626612025-10-21Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing…
CVE-2025-120042025-10-21Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in…
CVE-2025-627022025-10-21Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Ex…
CVE-2025-627012025-10-21Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories a…
CVE-2025-626942025-10-21Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Exte…
CVE-2025-626992025-10-21Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Trans…
CVE-2025-626962025-10-21Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboar…
CVE-2025-626952025-10-21Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Ex…
CVE-2025-626582025-10-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extensi…
CVE-2025-626572025-10-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms exten…
CVE-2025-626562025-10-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking…
CVE-2025-626972025-10-20Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - Langua…
CVE-2025-627002025-10-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerpl…
CVE-2025-626982025-10-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuida…
CVE-2025-626932025-10-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified…
CVE-2025-119372025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Ex…
CVE-2025-626712025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extensi…
CVE-2025-626702025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams…
CVE-2025-626692025-10-18Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exp…
CVE-2025-626682025-10-18Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affect…
CVE-2025-626672025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperim…
CVE-2025-626662025-10-18Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue af…
CVE-2025-626642025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating E…
CVE-2025-626632025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard…
CVE-2025-626622025-10-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearc…
CVE-2025-626552025-10-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows…
CVE-2025-626542025-10-17Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extens…
CVE-2025-626532025-10-17Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extensio…
CVE-2025-626522025-10-17Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extens…
CVE-2025-320802025-04-11Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resour…
CVE-2025-32079Medium6.52025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperime…
CVE-2025-320782025-04-11Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This…
CVE-2025-320772025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects M…
CVE-2025-320762025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Dat…
CVE-2025-320752025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extens…
CVE-2025-32074Medium5.42025-04-11Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This…
CVE-2025-32073Medium5.42025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML…
CVE-2025-320722025-04-11Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Media…
CVE-2025-32071Medium5.42025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message v…
CVE-2025-32070Medium5.42025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw…
CVE-2025-32069Medium5.42025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affe…
CVE-2025-32068Medium5.42025-04-11Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth…
CVE-2025-32067Medium5.42025-04-11Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affec…
CVE-2024-47841High7.52024-10-05Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path…
CVE-2024-47849Critical9.82024-10-05Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Inj…
CVE-2024-47847Medium6.12024-10-05Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows…
CVE-2024-47846High8.82024-10-05Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki -…
CVE-2024-47845High8.22024-10-05Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki…
CVE-2024-47840Medium4.82024-10-05Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin all…
CVE-2024-478482024-10-05Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This i…