CVE-2025-23081: Various security vulnerabilities in Extension:DataTransfer
Vulnerability summary
CVE-2025-23081 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in wikimedia foundation mediawiki - datatransfer extension. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.2% of scored vulnerabilities.
Timeline
- 14-01-2025PublishedVulnerability first disclosed.
- 13-03-2025Last modifiedVulnerability information updated.
Description
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.19% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Wikimedia foundation1 product
- mediawiki - datatransfer extension≥ 1.39.x, < 1.39.11 | ≥ 1.41.x, < 1.41.3 | ≥ 1.42.x, < 1.42.2
1 vendor · 1 product