Wikimedia Foundation Mediawiki Securepoll Extension vulnerabilities
3 vulnerabilities
Known vulnerabilities in Wikimedia Foundation Mediawiki Securepoll Extension, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-53485wikimedia foundationmediawiki - securepoll extension
EPSS score0.29%
SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.CVE-2025-53484wikimedia foundationmediawiki - securepoll extensionEPSS score0.54%
User-controlled inputs are improperly escaped in:
*
VotePage.php (poll option input)
*
ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names)
This allows attackers to inject JavaScript and compromise user sessions under certain conditions.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.CVE-2025-53483wikimedia foundationmediawiki - securepoll extensionEPSS score0.21%
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.