Wikimedia

14 CVEs across 10 Wikimedia products. Browse Wikimedia vulnerabilities, severities, and proof-of-concept exploits.

Wikimedia products with known CVEs

ProductCVEs
Wikidata Query Gui3
Parsoid2
Wikimedia-Extensions-Css2
Analytics-Quarry-Web1
Apex1
Campaignevents1
Mediawiki-Extensions-I18ntags1
Mediawiki-Extensions-Uploadwizard1
Scribunto1
Wikibase1
Wikimedia CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-34089High7.52026-05-11Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.
CVE-2025-61638Medium4.82026-02-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati…
CVE-2026-0817Medium5.32026-01-09Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - Campaign…
CVE-2026-22710Medium5.42026-01-09Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Exte…
CVE-2026-0671Medium6.12026-01-08Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard exte…
CVE-2024-47841High7.52024-10-05Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path…
CVE-2024-47845High8.22024-10-05Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki…
CVE-2024-47840Medium4.82024-10-05Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin all…
CVE-2018-25065Low3.52023-01-05A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18n…
CVE-2020-36324Medium6.12021-04-21Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.
CVE-2021-30458Medium6.12021-04-09An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transfor…
CVE-2019-19329Medium6.12019-11-27In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript…
CVE-2019-19328Medium6.12019-11-27ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI…
CVE-2019-19327Medium6.12019-11-27ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number…