The Wikimedia Foundation vulnerabilities, page 5

98 vulnerabilities

Known vulnerabilities in The Wikimedia Foundation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 76 products.

6.9MediumCVE-2026-58517mediawiki +1 moreBlocked users can create and edit WikiLambda objectsImproper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.EPSS0.33%9.8CriticalCVE-2026-58521mediawiki · cargo +1 moreSQLi in Cargo extension via year range filterImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.EPSS0.55%6.9MediumCVE-2026-58518mediawiki +1 moremediawiki mediawikiCross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.EPSS0.13%6.9MediumCVE-2026-58520mediawiki +1 moreUrlShortener defaults to ineffective validation open to third-party redirectsURL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.EPSS0.28%6.1MediumCVE-2026-100237the wikimedia foundation · mediawiki - thanks extensionStored i18n XSS in the Flow integration of ThanksImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.EPSS0.15%6.9MediumCVE-2026-22711the wikimedia foundation · mediawiki - wikilove extensionStored XSS through system messages in WikiLoveImproper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.EPSS0.29%2.3LowCVE-2026-22714the wikimedia foundation · mediawiki - monaco skini18n XSS, DoS and config SQLI in MonacoImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.EPSS0.37%5.4MediumCVE-2026-22710the wikimedia foundation · mediawiki - wikibase extension +1 moreStored XSS through autocomment system messages in WikibaseImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.EPSS0.19%5.4MediumCVE-2026-22713growth · growthexperiments +1 moreStored XSS through edit summaries in GrowthExperimentsImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.EPSS0.19%4.3MediumCVE-2026-22712the wikimedia foundation · mediawiki - approvedrevs extension +1 moreApprovedRevs allows bypassing the inline CSS sanitizerImproper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.EPSS0.24%2.9LowCVE-2026-96872the wikimedia foundation · mediawiki - wikilambda extensionWikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsImproper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.EPSS0.23%6.9MediumCVE-2026-96879the wikimedia foundation · mediawiki - flaggedrevs extension"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.EPSS0.26%6.9MediumCVE-2026-96878the wikimedia foundation · mediawiki - cargo extensionCargo Exhibit field alias allows stored XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.EPSS0.27%5.5MediumCVE-2026-96873the wikimedia foundation · mediawiki - cirrussearch extensionReflected XSS in CirrusSearch debug explain outputImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.EPSS0.27%2.3LowCVE-2026-96874the wikimedia foundation · mediawiki - cargo extensionStored XSS in Cargo Drilldown tab namesImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.EPSS0.20%6.9MediumCVE-2026-96876the wikimedia foundation · mediawiki - cargo extensionAnonymous reflected XSS in CargoExport invalid-alias errorsImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.EPSS0.27%6.9MediumCVE-2026-96877the wikimedia foundation · mediawiki - cargo extensionReflected XSS through Cargo Drilldown full-text searchImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.EPSS0.27%6.9MediumCVE-2026-96875the wikimedia foundation · mediawiki - cargo extensionReflected XSS in Cargo Drilldown hierarchy filtersImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.EPSS0.27%