CveMateVulnerability intelligence

Wikimedia Foundation vulnerabilities

152 vulnerabilities

Known vulnerabilities in Wikimedia Foundation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 68 products.

Products

49 of 68

Mediawiki55 vulnerabilities
Checkuser9 vulnerabilities
Mediawiki Cargo Extension4 vulnerabilities
Abusefilter3 vulnerabilities
Mediawiki Abusefilter Extension3 vulnerabilities
Mediawiki Checkuser Extension3 vulnerabilities
Mediawiki Securepoll Extension3 vulnerabilities
Mediawiki Campaignevents Extension2 vulnerabilities
Mediawiki Centralauth Extension2 vulnerabilities
Mediawiki Datatransfer Extension2 vulnerabilities
Mediawiki Ipinfo Extension2 vulnerabilities
Mediawiki Mintydocs Extension2 vulnerabilities
Mediawiki Proofreadpage Extension2 vulnerabilities
Mediawiki Templatesandbox Extension2 vulnerabilities
Mediawiki Uploadwizard Extension2 vulnerabilities
Mediawiki Wikibase Extension2 vulnerabilities
Mediawiki Wikilambda Extension2 vulnerabilities
Oathauth2 vulnerabilities
Parsoid2 vulnerabilities
Scribunto2 vulnerabilities
Timeline2 vulnerabilities
Vector2 vulnerabilities
Visualeditor2 vulnerabilities
Centralauth1 vulnerabilities
Cite1 vulnerabilities
Confirmedit1 vulnerabilities
Discussiontools1 vulnerabilities
Echo1 vulnerabilities
Luasandbox1 vulnerabilities
Mediawiki Approvedrevs Extension1 vulnerabilities
Mediawiki Articlefeedbackv5 Extension1 vulnerabilities
Mediawiki Breadcrumbs2 Extension1 vulnerabilities
Mediawiki CSS Extension1 vulnerabilities
Mediawiki Eventbus Extension1 vulnerabilities
Mediawiki Externaldata Extension1 vulnerabilities
Mediawiki Featuredfeeds Extension1 vulnerabilities
Mediawiki Flaggedrevs Extension1 vulnerabilities
Mediawiki Flow Extension1 vulnerabilities
Mediawiki Globalblocking Extension1 vulnerabilities
Mediawiki Googledocs4Mw Extension1 vulnerabilities
Mediawiki Masseditregex Extension1 vulnerabilities
Mediawiki Mediasearch Extension1 vulnerabilities
Mediawiki Msupload Extension1 vulnerabilities
Mediawiki Openbadges Extension1 vulnerabilities
Mediawiki Quiz Extension1 vulnerabilities
Mediawiki Refreshspecial Extension1 vulnerabilities
Mediawiki Relatedarticles Extension1 vulnerabilities
Mediawiki Reportincident Extension1 vulnerabilities
Mediawiki Scribunto Extension1 vulnerabilities

CVE-2013-4572debianmediawiki+46y ago06-02-2020 14:40

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.CVE-2013-4303debianmediawiki+36y ago11-12-2019 18:30

includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.CVE-2013-6451debianmediawiki+36y ago28-01-2020 14:56

Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.CVE-2013-6455mediawikimediawiki+16y ago28-01-2020 14:54

The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.CVE-2025-52738wikimedia foundationwikipedia preview+112mo ago22-10-2025 14:32

Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.CVE-2025-61647wikimedia foundationcheckuser8mo ago03-02-2026 00:02

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php. This issue affects CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4.CVE-2025-61645ubuntumediawiki+28mo ago03-02-2026 00:13

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.CVE-2025-61637debianmediawiki+38mo ago02-02-2026 23:54

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61646debianmediawiki+38mo ago03-02-2026 00:11

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61636debianmediawiki+38mo ago02-02-2026 23:23

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61653debianmediawiki+28mo ago03-02-2026 00:57

Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61649wikimedia foundationcheckuser8mo ago03-02-2026 00:17

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue affects CheckUser: from 7cedd58781d261f110651b6af4f41d2d11ae7309.CVE-2025-61648mediawikicheckuser+18mo ago03-02-2026 00:19

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, modules/ext.CheckUser.TempAccounts/SpecialBlock.Js. This issue affects CheckUser: from * before 1.44.1.CVE-2025-61657debianmediawiki+28mo ago03-02-2026 01:00

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.CVE-2025-61650wikimedia foundationcheckuser8mo ago03-02-2026 00:15

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue affects CheckUser: from * before 795bf333272206a0189050d975e94b70eb7dc507.CVE-2025-61655debianmediawiki+38mo ago03-02-2026 01:04

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61635debianmediawiki+28mo ago02-02-2026 23:26

Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This issue affects ConfirmEdit: *.CVE-2025-61638debianmediawiki+58mo ago02-02-2026 23:52

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.CVE-2025-61656debianmediawiki+38mo ago03-02-2026 01:02

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.CVE-2025-61642debianmediawiki+38mo ago02-02-2026 23:36

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.