Wikimedia Foundation
Page 2 of 2 — Wikimedia Foundation CVEs from a corpus of 152, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0670 | Medium | 6.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Ext… |
CVE-2026-0669 | High | 7.5 | 2026-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Trav… |
CVE-2026-0668 | Medium | 5.3 | 2026-01-07 | Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.T… |
CVE-2025-52738 | Medium | 6.5 | 2025-10-22 | Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-62665 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allo… | |
CVE-2025-7363 | Medium | 5.4 | 2025-07-08 | The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped… |
CVE-2025-7362 | Medium | 5.4 | 2025-07-08 | The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitizatio… |
CVE-2025-53479 | Medium | 5.4 | 2025-07-08 | The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper… |
CVE-2025-53480 | Medium | 5.4 | 2025-07-08 | The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered w… |
CVE-2025-53496 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Exten… |
CVE-2025-53499 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53498 | Medium | 5.3 | 2025-07-07 | Insufficient Logging vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Data Leakage Attacks.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53495 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53488 | Medium | 6.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extensi… |
CVE-2025-53478 | Medium | 5.4 | 2025-07-07 | The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages re… |
CVE-2025-53497 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles E… |
CVE-2025-53491 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Exten… |
CVE-2025-7057 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension al… |
CVE-2025-53487 | Medium | 5.4 | 2025-07-07 | The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper esca… |
CVE-2025-53486 | Medium | 5.4 | 2025-07-07 | The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escapi… |
CVE-2025-7056 | Medium | 6.3 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Exte… |
CVE-2025-53485 | High | 7.5 | 2025-07-04 | SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation… |
CVE-2025-53484 | Critical | 9.8 | 2025-07-04 | User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-contro… |
CVE-2025-53483 | High | 8.8 | 2025-07-04 | ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensi… |
CVE-2025-53482 | Medium | 6.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension… |
CVE-2025-53481 | High | 7.5 | 2025-07-04 | Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki -… |
CVE-2025-6926 | High | 8.8 | 2025-07-03 | Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - C… |
CVE-2025-53502 | Medium | 6.5 | 2025-07-03 | Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-53501 | High | 8.8 | 2025-07-03 | Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Auth… |
CVE-2025-53500 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Ext… |
CVE-2025-53489 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Ext… |
CVE-2025-53490 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Ex… |
CVE-2025-53494 | Medium | 6.5 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Ex… |
CVE-2025-53493 | Medium | 6.5 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extensi… |
CVE-2025-53492 | Low | 3.7 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extensi… |
CVE-2025-3469 | | 2025-04-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… | |
CVE-2025-32700 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program fil… | |
CVE-2025-32699 | | 2025-04-10 | Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.1… | |
CVE-2025-32698 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2025-32697 | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/Int… | |
CVE-2025-32696 | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/Reve… | |
CVE-2025-23074 | Low | 2.4 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misus… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2025-23072 | Medium | 5.4 | 2025-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Ex… |
CVE-2025-23081 | Medium | 6.1 | 2025-01-14 | Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Found… |
CVE-2025-23080 | Medium | 5.3 | 2025-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extens… |
CVE-2025-23079 | Medium | 6.1 | 2025-01-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5… |
CVE-2025-23078 | Medium | 6.5 | 2025-01-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 exte… |
CVE-2013-4572 | High | 7.5 | 2020-02-06 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies… |
CVE-2013-6455 | Medium | 5.3 | 2020-01-28 | The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors re… |
CVE-2013-6451 | Medium | 6.1 | 2020-01-28 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arb… |
CVE-2013-4303 | Medium | 6.1 | 2019-12-11 | includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detec… |